Home / Technology / Broken Ransomware Destroys Files Instead of Locking Them
Broken Ransomware Destroys Files Instead of Locking Them
29 Apr
Summary
- New ransomware variant VECT 2.0 corrupts files larger than 128 KB.
- Flawed nonce handling leads to permanent data loss, not encryption.
- Victims cannot recover data, even if ransom is paid.
Researchers have identified a new ransomware variant, VECT 2.0, which is functioning as a destructive data wiper rather than an encryptor. This critical flaw stems from improper nonce handling, leading to irreversible data loss for victims. Files exceeding a mere 128 KB are particularly vulnerable, meaning almost all important documents, databases, and backups are at risk.
Despite being marketed on dark web forums under a Ransomware-as-a-Service (RaaS) model and collaborating with threat actor TeamPCP, VECT 2.0's inherent defect prevents data recovery. Even if victims comply with ransom demands, the wiped data cannot be restored, rendering the ransomware's primary function entirely non-operational and its promises of recovery false.
