FlagThis

Abstract

Vect 2.0 is an emerging Ransomware-as-a-Service (RaaS) group that emerged in December 2025 and saw a surge in activity through February 2026. Using a custom C++ codebase and an "Exfiltration / Encryption / Extortion" model, the group targets critical sectors globally—primarily in Brazil and the US—employing advanced evasion techniques like Safe Mode execution and maintaining high operational security via TOR and Monero.