Recently, security researchers discovered that due to a program flaw in an emerging ransomware, all files larger than 128KB are actually permanently destroyed during the “encryption” process. The most frightening thing is that even if the victim pays the ransom, they cannot recover the files because even the attackers themselves cannot decrypt them. According to a report released by security company Check Point Research on April 28, a ransomware-as-a-Service (RaaS) called VECT 2.0, a service exclusively used by related fraud and extortion groups, has a critical programming flaw that causes its encryption mechanism to actually perform data destruction (wiper) rather than encryption when processing files exceeding 128KB.
VECT 2.0 Ransomware Exploits Fatal Program Error
VECT first appeared on Russian-language cybercrime forums in December 2025, and first launched attacks on enterprises in January 2026. In February this year, the organization launched a major revision of VECT 2.0, which it claims was rewritten from scratch and supports three platforms: Windows, Linux and VMware ESXi. It is all written in C++ and embedded with the libsodium encryption library.
Nonce overwriting error leads to permanent loss of data
The cryptographic flaw of VECT 2.0 lies in the way it handles nonces (one-time random numbers). Under normal circumstances, the ransomware will encrypt the file and save the nonce required for decryption in the file so that it can be decrypted and restored after subsequent ransom payment.
However, Check Point researchers found that for files exceeding 128KB (131,072 bytes), VECT 2.0 will divide the file into four blocks and encrypt them separately, but the loop of the program code will continuously write the newly generated nonce into the same memory buffer when processing each block – this means that the nonce of the first three blocks will be overwritten immediately after being generated, and ultimately only the nonce of the last block will be saved.
“Victims who paid the ransom were unable to obtain a working decryptor to restore their most important files, not because the ransomware operators were uncooperative, but because the nonce required for decryption no longer existed,” the Check Point research team noted.
Since the first three nonces are cryptographically randomly generated and never stored elsewhere, this means that the data in these blocks can never be restored, whether by victims, security researchers, or the attackers themselves.
The fatal threshold of 128KB
The 128KB threshold is arguably the most ironic part of this flaw. A high-resolution photo is generally about 2-5MB, a Word document is about hundreds of KB, and an email with an attachment is well over 128KB. In other words, almost all meaningful data in the enterprise environment: including virtual machine disks, database files, file files, backup data, and spreadsheets, once encrypted by VECT 2.0, cannot be restored to their original state.
To make matters worse, VECT 2.0 versions of all platforms: Windows, Linux, ESXi have the exact same encryption flaw because they share the same codebase.
It’s not just encryption that’s wrong: it’s full of amateur mistakes
Check Point researchers also discovered a series of amateur-grade bugs in VECT 2.0:
- Encryption Algorithm False Advertisement: This group claims to use ChaCha20-Poly1305 AEAD encryption, but in fact uses the original ChaCha20-IETF (RFC 8439) without an authentication layer and completely without Poly1305 MAC and integrity protection
- Dummy acceleration mode: Claims to provide three encryption speed modes (fast, medium, secure), but although the program code will parse these parameters, it directly ignores them and does not process them.
- Self-cancelling obfuscation techniques: The code obfuscation technique used makes the code easier to read due to implementation errors.
- Anti-analysis features never trigger: Built-in security circumvention tools are written in the code but are never enabled
- Thread scheduler backfires: The thread scheduler used to improve encryption performance actually reduces encryption efficiency.
Free to all BreachForums Crime Syndicate members
Despite VECT’s amateurish technical capabilities, its impact cannot be underestimated. The organization announced its cooperation with the cybercrime forum BreachForums, promising that every registered user can become an affiliate and use VECT’s ransomware toolkit, negotiation platform and data leakage website for free.
The Check Point research team noted in the report: “This cooperation has become fully effective in April 2026.” In other words, a large number of potential attackers are obtaining this flawed but extremely destructive weapon.
Additionally, VECT is allied with the notorious TeamPCP group. TeamPCP is behind a number of recent supply chain attacks, targeting open source projects such as Trivy, Checkmarx KICS, LiteLLM, and Telnyx. Their partnership targets organizations affected by supply chain attacks.
Check Point: There’s no point in paying, don’t pay.
Check Point researchers concluded: “Together, these findings paint a picture of a group with operational ambitions, from BreachForums’ open partner model to TeamPCP’s supply chain attacks, but whose cryptography and software engineering sophistication simply failed to match the scale at which they attempted to operate.”
For victims who have been attacked by VECT 2.0, security experts recommend:Don’t pay the ransom. Because the attacker does not have the decryption key that can restore your important data, paying money is just giving money to cybercriminals in vain.
Source: KOCPC Chinese