A ransomware-as-a-service operation marketed to cybercriminals as a professional extortion tool has been found to irreversibly destroy the files it claims to encrypt—making data recovery impossible for both victims and the attackers themselves, reports The Hacker News.
Check Point Research, a division of Check Point Software, published findings showing that VECT 2.0—a cross-platform Ransomware-as-a-service (RaaS) operation targeting Windows, Linux, and VMware ESXi environments—contains a coding flaw that effectively turns it into a wiper for any file larger than 128 KB. The vulnerability is present in all known versions of the malware and remains unpatched.
A Flaw in Nonce Handling with Irreversible Consequences
The technical root cause lies in how VECT 2.0 handles cryptographic nonces—values essential for reversing the encryption process. When the malware encounters a file larger than 131,072 bytes (128 KB), it splits it into four blocks and generates a new 12-byte nonce for each. However, instead of saving all four values, the program overwrites the same memory buffer each time, writing only the final nonce to the disk. The first three values are lost forever.
"Since ChaCha20-IETF requires both the 32-byte key and the exact 12-byte nonce to decrypt each block, the first three-quarters of any large file are unrecoverable by anyone—including the ransomware operator," Check Point’s analysis explains. Furthermore, the malware uses the pure ChaCha20-IETF cipher rather than the ChaCha20-Poly1305 AEAD claimed by the group.
As noted by JUMPSEC in an independent analysis, even a victim who pays the ransom and receives a working decryptor would only be able to recover 25 percent of each affected file. With a threshold of 128 KB—smaller than a typical email attachment—virtually all corporate data falls into the destroyed category.
A Flawed Operation Built on Ambitious Alliances
VECT launched its affiliate program in December 2025 and has since partnered with BreachForums and TeamPCP—the group behind recent developer tool supply chain compromises—to rapidly expand its reach. While the operation's affiliate panel appears professional, Check Point researchers discovered that many advertised features simply do not work: encryption speed settings are silently ignored, and anti-analysis protections are compiled into the code but never activated.
Check Point researchers noted that the nature of the errors suggests the group is likely composed of novices rather than seasoned operators, and that the use of AI for code generation "cannot be ruled out." Tom's Hardware reported that Check Point believes the code was "likely written in a vibe-coding mode with AI." Notably, the malware includes Ukraine in a list of CIS countries exempt from attacks—a detail suggesting the codebase was inherited from pre-2022 Russian-speaking ransomware groups rather than built from scratch.
What This Means for Victims
"CISOs must understand that in a VECT incident, paying the ransom is not a recovery strategy," said Eli Smadja, a team lead at Check Point Research. "The focus must be on resilience: offline backups, tested recovery procedures, and rapid containment—not negotiation."
Follow NEWS.am Tech on Facebook and Twitter