Ransomware Group intelligence
Vexy Ransomware
ActiveTrack Vexy Ransomware with 24 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Vexy Ransomware is tracked by Breach House as a ransomware group with 24 published victims.
India is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
24
- Leaked 12 50.0%
- Pending 8 33.3%
- Deleted 4 16.7%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 5h ago | vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion |
Top Activity Sectors (8)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Vexy Ransomware, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Vexy Ransomware executes malicious commands through PowerShell scripts to deploy payloads and manipulate system behavior.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: Vexy Ransomware modifies Windows Registry Run keys and startup folders to ensure persistence across reboots.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Vexy Ransomware disables antivirus tools by modifying Windows Defender and security service configurations to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Vexy Ransomware deletes Volume Shadow Copies and backup directories via vssadmin and command-line tools to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: Vexy Ransomware uses file and directory discovery via PowerShell to enumerate critical user and system folders before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1560.001 Archive via Utility Collection
What they do: Vexy Ransomware archives victim data using built-in utility commands before exfiltration to maintain leverage.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: Vexy Ransomware encrypts victim files using AES-256 symmetric encryption, targeting documents, images, and business data.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Vexy Ransomware inhibits system recovery by terminating critical Windows services like backup and monitoring utilities.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (24)
Search, filter and paginate the victim timeline for Vexy Ransomware. Showing 1–24 of 24.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | polisee Inc id34949 View details | United States | IT | — | pending | |
|
polisee Inc. is a Japanese technology company that develops and operates an AI-powered policy intelligence platform. Its software automates the monitoring, collection, analysis, and sharing of government policy and regulatory information. It uses AI to summarize policy discussions, organize complex documents, and provide real-time alerts, helping businesses and institutions anticipate regulatory changes, manage compliance risks, and identify new business opportunities. |
||||||
| Ransomware | Data-Core Systems id34683 View details | United States | IT | — | pending | |
|
Data-Core Systems is an IT consulting and technology services company incorporated in 1988. It helps organizations with digital transformation, SAP implementation, AI and machine learning, data analytics, cloud migration, application development, publishing, and business process solutions. It serves industries including healthcare, manufacturing, government, finance, retail, and energy. |
||||||
| Ransomware | Enchanted Fine Jewellery id33880 View details | India | — | — | pending | |
|
enchantedfinejewellery.in |
||||||
| Ransomware | Guarufilme id33805 View details | Brazil | — | — | pending | |
|
The company has operated in the packaging sector since 2006, manufacturing PVC and polyethylene films for domestic and industrial applications. |
||||||
| Ransomware | KOOKABARRA JUICE id33521 View details | Australia | Education | — | pending | |
|
French manufacturer specializing in fresh-pressed fruit juices, detox juices, smoothies, nectars and other fresh fruit products, serving both professionals and consumers. |
||||||
| Ransomware | Summit Electric Supply id33355 View details | United States | IT | — | pending | |
|
Summit Electric Supply supplies electrical products and solutions for commercial, industrial, construction, OEM, institutional, and marine applications. Its website allows customers to browse products, check availability, manage orders, view invoices, and purchase online. |
||||||
| Ransomware | Groupe Proxitel id33275 View details | Timor-Leste | Telecommunications | — | pending | |
|
French B2B technology provider offering professional Internet connectivity (fiber/DSL, 4G/5G backup), fixed and mobile telephony, cybersecurity, IT backup, collaboration, networking and computer hardware. The group is based in Avignon and serves businesses and public-sector organizations. |
||||||
| Ransomware | Majani Insurance Brokers id33166 View details | Kenya | Finance / Legal / Insurance | — | pending | |
|
Majani Insurance Brokers is an independent insurance broker serving both businesses and individuals. It arranges insurance products across areas including general business insurance, motor, medical, life, investment, marine, liability, property and agricultural-related covers |
||||||
| Ransomware | Quy Nhon University id32990 View details | Viet Nam | Education | — | leaked | |
|
Quy Nhon University (QNU) is a public, multidisciplinary university located in Quy Nhon City, Binh Dinh Province, Vietnam. Established in 1977, the university has a long-standing tradition in teacher education and has developed into a comprehensive institution offering a wide range of academic programs. |
||||||
| Ransomware | STP Fashion Lab id32920 View details | Italy | Retail / E-commerce | — | leaked | |
|
stpfashionlab.it is the website of STP Fashion Lab, a Tuscan company that has specialized in making Made in Italy womenswear for over twenty years. It produces the FRIVOLITÉ brand, founded in 2019, which targets independent, sensitive, and playful women. |
||||||
| Ransomware | Hashimoto Jimuki id32877 View details | Japan | IT | — | leaked | |
|
Japanese company providing office equipment, IT equipment and services, office furniture, meeting/conferencing systems, and computer support. |
||||||
| Ransomware | Strad Solutions id32996 View details | United Kingdom | IT | — | leaked | |
|
Strad Solutions provides cloud hosting, dedicated servers, managed IT, cybersecurity, and disaster recovery services for businesses worldwide. |
||||||
| Ransomware | i2k2 Networks id32751 View details | India | IT | — | leaked | |
|
i2k2 Networks Pvt. Ltd., established in 1999, is a leading Indian provider of cloud computing, web hosting, managed IT, data center, backup, disaster recovery, and DevOps solutions. With 25+ years of experience, 4,000+ customers, Tier III-compliant data centers, and 24/7 support, i2k2 delivers secure, scalable, and reliable IT solutions worldwide. |
||||||
| Ransomware | Logar Network Solutions id32716 View details | Brazil | Services | — | leaked | |
|
Logar Network Solutions is a Brazilian managed IT services provider (MSP) that delivers outsourced IT management, cybersecurity, cloud infrastructure, backup and disaster recovery, software licensing, hardware lifecycle management, and custom software development. The company primarily serves medium-sized businesses across multiple industries, offering 24/7 IT monitoring and support. It has served more than 500 companies and operates across six Brazilian states. |
||||||
| Ransomware | United Group id32643 View details | India | Services | — | leaked | |
|
United Group is a diversified Indian business group delivering innovative products and services across multiple industries. Founded in 2003, the company began as a food and beverage consultancy and has since expanded into food ingredients, nutraceuticals, industrial machinery, infrastructure, fashion, digital branding, packaging, and automotive accessories. With a strong focus on quality, innovation, and customer satisfaction, United Group operates through a network of specialized businesses, serving clients across India and international markets. Backed by certified manufacturing facilities and experienced professionals, the group is committed to providing reliable, sustainable, and value-driven solutions that support business growth and long-term success. |
||||||
| Ransomware | LIBRERIA SANTA FE A P S SRL id32628 View details | Argentina | Telecommunications | — | deleted | |
|
LSF (Librería Santa Fe) is a bookstore based in Buenos Aires, Argentina, with multiple branches across the city (CABA). It offers a wide selection of both national and imported books across various genres and authors. The store provides an easy online shopping experience where customers can browse and purchase titles with just a few clicks. It also maintains an active social media presence on Instagram (@libreriasantafe) to share news, promotions, and updates. Visitors are welcome to visit their physical locations in person. |
||||||
| Ransomware | Sancity id32618 View details | India | Finance / Legal / Insurance | — | leaked | |
|
An active, unlisted public company incorporated in 2012, operating in real estate/construction and real-estate marketing & sales |
||||||
| Ransomware | McDonalds Ecuador id32612 View details | Ecuador | Hospitality / Food & Beverage / Tourism | — | deleted | |
|
McDonalds Ecuador is the local franchise operation of the global McDonalds brand. The company operates fast-food restaurants across Ecuador, offering products such as burgers, fries, beverages, breakfast items, and childrens meals. It operates under the McDonalds franchise model through Arcos Dorados, the largest McDonalds franchise operator in Latin America and the Caribbean. |
||||||
| Ransomware | Mega Velocity id32605 View details | Mexico | Transportation / Travel / Logistics | — | leaked | |
|
New Delhi–based private technology company incorporated in 2013. Its registered business classification is software publishing, consultancy and supply, including software development, maintenance and web-page design. Its network records also identify MEGA VELOCITY PVT LTD as an Internet/hosting network operator. |
||||||
| Ransomware | Palsana Enviro (PEPL) id32582 View details | India | Services | — | leaked | |
|
Environmental services company operating a Common Effluent Treatment Plant (CETP) for textile-processing industries. PEPL collects, treats and disposes of industrial wastewater and also recycles treated water for member industries. Its current stated treatment capacity is 150 MLD, with 50 MLD recycling capacity. |
||||||
| Ransomware | Annapurna Fashion id32583 View details | India | Retail / E-commerce | — | deleted | |
|
Manufacturer, supplier and exporter/distributor of fabrics and apparel-related products, including cotton fabrics, shirting, suiting, jacquard, sherwani fabrics, uniforms, ladies' tops and readymade garments |
||||||
| Ransomware | Sancity Soft Touch id32584 View details | United States | Retail / E-commerce | — | leaked | |
|
IT services company providing web design & development, software/application development, payment gateway services, digital marketing, mobile applications, software testing and cloud-related services. |
||||||
| Ransomware | McDonald's Ecuador id32450 View details | Ecuador | Hospitality / Food & Beverage / Tourism | — | deleted | |
|
McDonald's Ecuador is the local franchise operation of the global McDonald's brand. The company operates fast-food restaurants across Ecuador, offering products such as burgers, fries, beverages, breakfast items, and children's meals. It operates under the McDonald's franchise model through Arcos Dorados, the largest McDonald's franchise operator in Latin America and the Caribbean. |
||||||
| Ransomware | Engefitas id32444 View details | Brazil | Services | — | leaked | |
|
Engefitas is a Brazilian company that produces various adhesive tapes and adhesives for industries like packaging, automotive, construction, electronic, and manufacturing sectors. |
||||||