Check Point: VECT 2.0 Wipes Most Files, Not Ransomware

Cybersecurity researchers at Check Point Research have uncovered a critical flaw in VECT 2.0, a ransomware-as-a-service operation that launched in December 2025, revealing it functions primarily as a data wiper rather than a reversible encryptor for most files.

The malware targets systems running Windows, Linux, and VMware ESXi. When processing files larger than 128 kilobytes, VECT splits them into four chunks and generates a unique 12-byte nonce for each to enable encryption with ChaCha20. However, it reuses a single shared buffer, overwriting the first three nonces and storing only the final one with the file. This renders the initial three-quarters of each affected file permanently irrecoverable, even if attackers possess the master key. Files below this threshold encrypt normally, but researchers note that virtually all enterprise-critical data, such as virtual machine images, databases, backups, and archives, exceeds 128 KB.

"VECT is being marketed as ransomware, but for any file over 128 KB, which is most of what enterprises actually care about, it functions as a data destruction tool," said Eli Smadja, group manager at Check Point Research. He added that paying the ransom...