Threat Intelligence Report Sep 8 - Sep 14 2026

Worldwide Ransomware Victims

Worldwide ransomware victim distribution shows that the United States was the most affected country, with 93 victims, accounting for 45.81% of the total ransomware activity. This indicates that nearly half of all reported ransomware victims were located in the United States, making it the primary target region during this period.

Canada recorded the second-highest number of victims, with 13 cases, representing 6.40% of the total. Brazil followed with 9 victims, contributing 4.43%, while Germany recorded 8 victims, accounting for 3.94% of overall ransomware activity.

Other countries with notable ransomware impact included Australia, with 7 victims, representing 3.45%. Argentina and India each reported 6 victims, contributing 2.96% individually. South Africa and Italy each recorded 5 victims, accounting for 2.46% individually.

Moderate ransomware activity was observed in the United Kingdom and Spain, each with 4 victims, representing 1.97% individually. Philippines, Mexico, Sweden, and Türkiye each recorded 3 victims, contributing 1.48% individually.

Several countries reported lower but notable activity, including Myanmar, France, Portugal, Peru, Saudi Arabia, and Colombia, each recording 2 victims, accounting for 0.99% individually.

The remaining countries recorded 1 victim each, representing 0.49% individually. These included South Korea, Ecuador, Chile, United Arab Emirates, Egypt, Ireland, Pakistan, Switzerland, Denmark, Slovakia, Netherlands, Austria, Taiwan, Sri Lanka, Oman, Bosnia and Herzegovina, Serbia, Japan, and Hong Kong.

Overall, the data shows that ransomware activity was heavily concentrated in the United States, which accounted for nearly half of all reported victims. However, significant activity across North America, South America, Europe, Asia-Pacific, the Middle East, and Africa highlights the continued global reach of ransomware operations and the persistent targeting of organizations across diverse regions.

Ransomware Group in Focus

Vexy Ransomware

Executive Summary 

Vexy is a newly observed extortion operation with a functioning Tor publication site and an affiliate offer that claims Windows, Linux, and VMware ESXi locker builds. Public monitoring places its emergence in early September 2026. The strongest evidence establishes the actor brand, leak-site activity, one onion service, one qTox identity, and the text of the affiliate offer. It does not establish a deployed encryptor. [1][2][3]

RansomLook captured seven Vexy publication records from 5 through 11 September. No named organization, regulator, law-enforcement body, or published incident-response investigation independently confirmed these six new claims by the research cutoff. [1][4][5][6]

Technical attribution remains low confidence. ANY.RUN searches for the actor name and exact onion site returned no analyses. Public searches for MalwareBazaar, ThreatFox, URLhaus, Hybrid Analysis, Triage, Malpedia, and No More Ransom produced no attributable Vexy sample or decryptor. [7][8][9][10][15]

Ransomware Group Overview

Origin and Public Profile

WatchGuard lists Vexy as active, first seen in September 2026, and categorizes it as a data broker using direct and double extortion. RansomLook recorded 12 total posts through the cutoff, one onion service, one qTox identity, and a last post on 10 September at 23:43 UTC. These platforms largely observe the same actor-controlled artifacts, so their agreement is corroborating publication activity rather than independent proof of intrusions. [1][3]

No confirmed alias, predecessor group, operator nationality, language origin, development team, access broker, or relationship to an established ransomware brand was identified. Attribution beyond the Vexy public persona would be speculative.

Operating Model

RansomLook preserves affiliate rules marked in force from 2 September and is attributed to ReHub. The offer claims a Rust codebase, build configuration, negotiation and ticket functions, analytics, multilingual support, Tor access, and invite-code registration for a one-time USD 200 Bitcoin payment. The qTox identity and Tor blog address in the rules match the group profile. [1][2]

The advertisement supports a moderate-confidence judgment that Vexy sought for affiliates. It does not prove the advertised builders were delivered, functional, or used against any named organisation. No revenue-share terms, affiliate vetting criteria, forbidden target rules, escrow arrangements, or payment-splitting mechanism were visible in the preserved text.

Extortion Behaviour

The operator uses public naming and threatens disclosure to create pressure. Secondary reports repeat alleged data volumes for several posts, but no primary evidence confirms data possession, publication completeness, ransom amount, payment, negotiation outcome, or operational disruption. The public record cannot distinguish a successful intrusion from exaggerated, recycled, or misattributed data. [4][11][12][13] 

Infrastructure

One Tor v3 service and one qTox identity are attributable to the Vexy public persona. RansomLook reported a 33% average onion uptime over 30 days and showed the service down at collection time. No clearnet mirror, hosting IP, passive-DNS chain, TLS certificate, cryptocurrency wallet, or confirmed negotiation endpoint was established. [1][2]

Technical Analysis

Observed Evidence Boundary

No public Vexy binary, ransom note, encrypted-file extension, decryptor, configuration extraction, reverse-engineering report, or victim forensic narrative was located. There is therefore no basis for a Vexy-specific hash blocklist, YARA rule, encryption description, process tree, command-line list, registry signature, service name, mutex, or network protocol profile.

Advertised Locker Capabilities

The affiliate text is direct evidence of what the operator advertised, not evidence that the software performs as described. The cryptographic implementation, key generation, error handling, exclusions, process lists, share enumeration, speed, and recovery behavior remain untested. [2]

Attack Lifecycle

Initial Access through Collection

No Vexy-specific initial-access vector, exploited vulnerability, phishing lure, credential source, persistence mechanism, privilege-escalation method, discovery command, lateral-movement tool, staging method, or exfiltration utility is confirmed. These phases must remain in intelligence gaps. Generic ransomware patterns are useful for coverage planning but cannot be written as Vexy behavior.

Exfiltration and Extortion

Public naming and disclosure pressure are directly observable. Alleged data volumes and claims of stolen internal material originate with the operator or services reproducing the operator's text. Defenders should investigate archive creation and abnormal egress when responding to a suspected case, but the Vexy exfiltration tool and destination are unknown.

Impact

The observable impact is reputational and operational pressure created by public claims. File encryption, service interruption, data destruction, backup impairment, and payment are unverified. A Vexy attribution should require a ransom note, binary, endpoint telemetry, negotiation artifact, or other technical anchor.

Indicators and Observables

The onion is publication infrastructure, and the qTox value is an actor contact identity. Neither proves infection on an endpoint. The qTox identity is retained for intelligence correlation, not automatic blocking.

Mitigation and Response Recommendations

Identity and Remote Access

Require phishing-resistant multifactor authentication for email, VPN, remote administration, and privileged access. Remove unused internet-facing services, restrict administrative access to managed jump hosts, rotate exposed credentials, and review third-party access. CISA identifies compromised credentials and exposed remote services as recurring ransomware entry paths. [14]

Network and Virtualization

Separate user, server, backup, storage, and virtualization management networks. Permit SMB and NFS only where required. Protect ESXi and vCenter with dedicated administration paths, separate credentials, restricted interfaces, and logging outside the managed environment.

Backups and Recovery

Maintain offline or logically isolated backups, use separate backup-administration identities, enable immutability where supported, and test representative restorations. Document dependencies and recovery priorities before an incident. [14]

Containment and Evidence

If destructive activity is suspected, isolate affected systems, disable compromised accounts, preserve volatile and disk evidence when feasible, and use out-of-band communications. Determine scope from telemetry and forensic evidence rather than from an actor post alone. [14]

Crystal Eye Control Alignment

- CE Advanced Firewall: Enforce segmentation between user, server, backup, storage, and hypervisor networks; restrict east-west administrative traffic.

- CE Intrusion Protection Detection and Local Rules: Correlate remote administration, file sharing, service control, log clearing, recovery impairment, high-volume file change, and sustained outbound transfer; use the onion only as supporting context.

- CE Web Filter Antiphishing Antivirus and Protocol Filter: Block credential-harvesting traffic, apply behavior detection, and restrict unnecessary Tor, qTox, SMB, NFS, and remote administration.

Confidence Assessment

Known Gaps

• No independently confirmed victim statement, regulatory filing, law-enforcement confirmation, or incident-response narrative for an in-window claim.
• No attributable malware binary, ransom note, extension, configuration, process tree, reverse engineering, YARA rule, or decryptor.
• No confirmed initial access, affiliate identity, access broker, credential source, exploited vulnerability, or phishing material.
• No validated persistence, privilege escalation, discovery, lateral movement, staging, exfiltration, encryption, or recovery-inhibition method.
• No confirmed ransom demand, wallet, payment, negotiation transcript, settlement, or data-publication verification.
• No confirmed relationship to another operator, malware family, prior brand, country, or development team.
• VirusTotal authentication/file views and OTX pulse/indicator results were incomplete; MalwareBazaar required a browser verification challenge.
  
  

References

[1] RansomLook, "Vexy group profile and post archive," https://www.ransomlook.io/group/vexy

[2] RansomLook, "Vexy affiliate program rules," https://www.ransomlook.io/group/vexy/raas-rules

[3] WatchGuard Threat Lab, "Vexy Ransomware," https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/vexy

[4] Ransomwhere, "Vexy and current ransomware tracking views," https://ransomwhere.org/

[5] SOCRadar, "Logar Network Solutions claimed victim record," https://socradar.io/free-tools/ransomware-intelligence/victims/logar-network-solutions-vexy-ransomware-d119fce2

[6] BorealSec Intel, "Vexy Ransomware victim geography view," https://intel.borealsec.io/ransomware/map/?group=vexy-ransomware&window=30d

[7] ANY.RUN, "Public submissions search," https://app.any.run/submissions/

[8] MalwareBazaar, "Sample database and VexxStealer search results," https://bazaar.abuse.ch/browse/

[9] ThreatFox, "VexxStealer tag records," https://threatfox.abuse.ch/browse/tag/VexxStealer/

[10] URLhaus, "VexxStealer payload records," https://urlhaus.abuse.ch/browse/signature/VexxStealer/

[11] Threadlinqs Intelligence, "Mega Velocity claim and Vexy profile," https://intel.threadlinqs.com/threat/TL-2026-2363

[12] GalaxyWarden, "Sancity unverified claim," https://www.galaxywarden.com/blog/breach/sancity-vexy-ransomware-2026-09

[13] GalaxyWarden, "United Group unverified claim," https://www.galaxywarden.com/blog/breach/united-group-vexy-ransomware-2026-09

[14] Cybersecurity and Infrastructure Security Agency, https://www.cisa.gov/stopransomware/ransomware-guide

[15] No More Ransom, "Decryption tools catalogue," https://www.nomoreransom.org/en/decryption-tools.html