Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error

darkreading
Actively Exploited

Overview

A new strain of ransomware known as Vect 2.0 is being deployed against organizations affected by the TeamPCP supply chain attacks. However, security experts warn that paying for a decryptor might not be wise, as a design flaw in the ransomware makes it function more like a wiper than traditional ransomware. This means that instead of simply encrypting files for ransom, it may permanently erase data. Companies that have been impacted need to be cautious, as the ramifications of this ransomware could lead to significant data loss. Organizations should prioritize data backups and consider their recovery options before engaging with the attackers.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Vect 2.0 ransomware, TeamPCP supply chain attack victims
  • Action Required: Organizations should focus on data backups and recovery strategies; no specific patches or updates mentioned.
  • Timeline: Newly disclosed

Original Article Summary

The emerging ransomware has been deployed against victims of the TeamPCP supply chain attacks, but organizations should think twice before paying for a decryptor.

Impact

Vect 2.0 ransomware, TeamPCP supply chain attack victims

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should focus on data backups and recovery strategies; no specific patches or updates mentioned.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Ransomware.

Related Coverage

Roku sued for allegedly bricking TVs - see which models are affected, and your best alternatives

Latest news

Roku is facing a lawsuit after numerous users reported that their Roku TVs have become unusable, either getting stuck in boot loops or displaying black screens. This issue affects several models, leading to frustration among customers who rely on these devices for streaming. Users have taken to social media and forums to express their dissatisfaction, prompting legal action against the company. The situation raises concerns about the reliability of Roku devices and the potential need for better customer support and product durability. As these issues continue, affected users are encouraged to seek alternatives while the lawsuit unfolds.

May 6, 2026

Why ransomware attacks succeed even when backups exist

BleepingComputer

Ransomware attacks are increasingly successful even when organizations have backups, primarily because attackers often target and destroy these backups before encrypting the main data. Acronis explains that this tactic leaves victims with little to no options for recovery, as the backups become unusable. This highlights a significant vulnerability in many organizations' cybersecurity strategies, as they may rely too heavily on backups without considering their protection. Companies need to bolster their defenses by securing backup systems and implementing strategies that can withstand ransomware attacks, ensuring they have a path to recovery even if their primary data is compromised.

May 6, 2026

CISA Urges Critical Infrastructure Providers to Make Plans to Remain Operational if hit by Cyber-Attack

Infosecurity Magazine

CISA has launched the CI Fortify initiative, urging critical infrastructure operators to develop plans to stay operational in the event of a cyber-attack. This initiative is designed to help these operators create systems for isolating affected areas and recovering from attacks quickly. The focus is on ensuring that essential services, such as power, water, and transportation, remain functional even when targeted by cyber threats. The call to action comes as cyber threats continue to evolve, making it crucial for these operators to have effective response strategies in place. CISA emphasizes that preparation can significantly mitigate the impact of potential attacks on public safety and national security.

May 6, 2026

After the identity fix: MCP's confused deputy problem

SCM feed for Latest

The article discusses a potential issue with AI agents acting as 'confused deputies,' which means they may perform unintended actions based on users' requests. This can lead to security vulnerabilities where the AI might execute commands that the user did not intend, potentially exposing sensitive data or causing other negative consequences. The implications of this problem are significant, as it raises concerns about the reliability and safety of AI systems in various applications. Users and developers need to be aware of these risks to ensure that AI implementations are secure and do not inadvertently compromise user intentions. As AI technology becomes more prevalent, addressing these issues will be crucial for maintaining trust and safety in digital environments.

May 6, 2026

Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE

Security Affairs

Apache has released updates to address multiple vulnerabilities in its HTTP Server, including a serious flaw identified as CVE-2026-23918. This vulnerability, which has a CVSS score of 8.8, is a double-free error in the handling of HTTP/2 requests. If exploited, it could allow attackers to execute arbitrary code on affected systems. Organizations using Apache HTTP Server, particularly those enabling HTTP/2, should prioritize updating their software to mitigate this risk. The nature of the flaw makes it critical for system administrators to be proactive in applying the latest patches to safeguard against potential attacks.

May 6, 2026

CISA: Critical Infrastructure Must Master Isolation, Recovery

SecurityWeek

The Cybersecurity and Infrastructure Security Agency (CISA) has released guidance aimed at helping operators of critical infrastructure bolster their defenses against potential cyberattacks from foreign adversaries. This guidance stresses the importance of mastering isolation and recovery strategies to mitigate damage from attacks. Given the rising number of cyber threats targeting vital systems, this advice is particularly relevant for sectors like energy, transportation, and public health. By implementing these practices, organizations can better prepare for incidents, ensuring that they can maintain operations and recover swiftly after an attack. This proactive approach is essential for safeguarding national security and economic stability.

May 6, 2026