Vexy-ransomware
Vexy-ransomware is a ransomware group with a financial motive, tracked by Brandefense. It targets 8 sectors, including Technology and Manufacturing, in 11 countries, including the United States and India.
- Vexy
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Sep 3, 2026
- Last seen
- Sep 7, 2026
- Record updated
Who They Target.
About Vexy-ransomware.
Vexy is an emerging ransomware and data-extortion operation first publicly observed in September 2026 and assessed to be financially motivated. The operation advertises a private affiliate program with Windows, Linux, and ESXi lockers, a Tor-based control panel, and a dedicated data leak site. Public trackers have recorded multiple leak-site victim claims, but the advertised technical capabilities and claimed compromises have not been independently corroborated through publicly available malware analysis or victim confirmation.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.