Analysis of VECT 2.0 ransomware reveals critical Windows-specific implementation flaws, including buffer-size mismatches, race conditions from shared global state, and incomplete nonce retention. These defects result in files being partially encrypted, inconsistently modified, or structurally damaged, rendering the attacker's own decryptor incapable of reliable data recovery.
ChaCha20
2 posts
VECT: Ransomware That Can’t Decrypt Inside Pay2Key: Technical Analysis of a Linux Ransomware Variant Morphisec Threat Labs analyzed a Linux variant of the Iranian-attributed Pay2Key ransomware. The malware requires root privileges to execute, utilizes a JSON configuration file, disables system defenses like SELinux and AppArmor, and employs ChaCha20 for full or partial file encryption while lacking built-in network C2 or exfiltration capabilities.