What is Vect ransomware?

Vect is a ransomware-as-a-service program that began recruiting affiliates in late December 2025. A core team supplies the encryptor and leak site, and affiliates run the intrusions. Brandefense Blackhole saw 25 Vect leak-site claims from January to 27 October 2026.

Is Vect linked to TeamPCP?

Yes. On 25 March 2026 Vect announced a partnership with TeamPCP, and Sophos, Check Point and Halcyon all report it. Sophos confirmed at least one Vect deployment that used TeamPCP-sourced credentials. TeamPCP told Sophos it had never used Vect’s encryption tools.

What did the forum partnership offer?

The edited 25 March catalogue description promises an affiliate key and deployment help to forum members. A later statement says keys were sent. Neither establishes a verified participant count, delivery or an intrusion.

Can Vect victims get their files back?

Check Point says files larger than 128 KB cannot be fully recovered, including by the operator, because three of four nonces are lost. Smaller files remain decryptable with the correct key. Sophos warns that paying may not restore data. A free decryptor was offered on 29 May, which we did not test.

How many victims has Vect claimed?

It depends on the source. Brandefense Blackhole counts 25 claims in 2026, Halcyon about 23 before the alliance, and Sophos reports two campaign-labeled victims on the leak site. Vect itself claimed 154 attacked organizations, a figure we cannot verify.

Is Vect still active?

We saw no Vect claim after 15 April 2026. That can mean a pause, a rename, a move off the channels we read or an end. Vendor reports we read date from April and May, so we cannot say more.