// THREAT ACTOR
VECT_
DormantVECT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of VECT — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 27
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onionVECT RANSOMWARE // DATA ARCHIVE snapshot · 2026-01-21 17:17 -
158.94.210.11.snapshot · 2026-01-06 14:06 -
vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onionVECT RANSOMWARE // DATA ARCHIVE snapshot · 2026-05-02 18:10
Recent victims
The 50 most recent victims claimed by VECT. Total in the index: 27.
| Date listed | Victim | Description |
|---|---|---|
| 2026-04-15 | S&PGLOBAL, LiteLLM/Trivy campaign (TeamPCP) | SECTOR: Business Services • … |
| 2026-04-15 | guesty, LITELLM/TRIVY CAMPAIGN (TEAMPCP) | SECTOR: property management • … |
| 2026-03-04 | Verlat Energy | SECTOR: Energy • COUNT… |
| 2026-03-01 | USHA International Limited | SECTOR: manufacturer • … |
| 2026-02-28 | pappytech | SECTOR: E-commerce • C… |
| 2026-02-28 | Casas del Mediterraneo | SECTOR: Real Estate … |
| 2026-02-28 | keliweb | SECTOR: IT • COUNTRY: … |
| 2026-02-28 | jdaas | SECTOR: IT • COUNTRY: … |
| 2026-02-25 | Sus Insumos S.A.S | SECTOR: Seller • COUNT… |
| 2026-02-25 | Del Rey | SECTOR: IT • COUNTRY: … |
| 2026-02-25 | Pappytech | SECTOR: retail • COUNT… |
| 2026-02-24 | s***om****x | SECTOR: Healthcare • C… |
| 2026-02-24 | a*f***a | SECTOR: Healthcare • C… |
| 2026-02-24 | ****360.com | SECTOR: healthcare logistics • … |
| 2026-02-24 | ***wire | SECTOR: LAW • COUNTRY:… |
| 2026-02-24 | for******a****ng | SECTOR: Finance • COUN… |
| 2026-02-24 | pay*** | SECTOR: Finance • COUN… |
| 2026-02-24 | Auvo | SECTOR: IT • COUNTRY: … |
| 2026-02-24 | MB Contabilidade | SECTOR: accounting • COUNTRY: BR • SITE: https://mbcontabilidade.com.b… |
| 2026-02-24 | ApexHospitals | SECTOR: healthcare • SITE: apexhospitals.com Employee personally id… |
| 2026-02-24 | EnerTec | SECTOR: Manufacturing • COUNTRY: ZA • SITE: enertec.co.za Databases… |
| 2026-02-24 | Mutualista Imbabura | SECTOR: Finance • COUNTRY: Ecuador • SITE: mutualistaimbabura.com C… |
| 2026-02-24 | Was Madeiras | SECTOR: Manifacturer • COUNTRY: BR • SITE: wasmadeiras.com.br/ Prod… |
| 2026-02-24 | Grupo VerdeAzul | SECTOR: asset management • COUNTRY: NA • SITE: Grupoverdeazul.com │… |
| 2026-02-24 | AUVO | Auvo SECTOR: IT • COUNTRY: Brazil • SITE: auvo.com │ ├─Purchasin… |
| 2026-01-08 | Federal University of Sergipe | SECTOR: Education • CO… |
| 2026-01-06 | Hytec South Africa | SECTOR: Engineering Solutions • COUNTRY: SA • SITE: hytec.com All d… |
// CONFIRMED ATTACKS
Vect confirmed attacks: 1 verified incident
Ransomnews has verified 1 Vect incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in January 2026. Italy accounts for 1 of them (100%). The most affected sector is technology, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Vect incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| January 2026 | Keliweb | Technology | Rende, Italy | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Vect's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.