VEXY Ransomware Gang: 3 Technology Sector Victims in 5 Days — MSP Targeting Analysis & Detection Rules

Classification: TLP:AMBER | Publication Date: 2026-09-14 | Source: Live dark web leak site monitoring via ransomware.live

Executive Summary

Security Arsenal's dark web monitoring infrastructure has confirmed 3 new victims posted to the VEXY RANSOMWARE leak site within a 5-day window (2026-09-09 through 2026-09-12). All three victims operate in the Technology sector, spanning United Kingdom, India, and Brazil — a geographic dispersion pattern consistent with opportunistic edge-device exploitation rather than regionally focused social engineering.

The victim profile is notable: all three organizations (Strad Solutions, i2k2 Networks, Logar Network Solutions) are technology service providers and network/IT infrastructure companies. This is the classic upstream-leverage targeting model — compromising technology providers to gain downstream access to their clients. Organizations that consume managed services, co-location, or network solutions from technology vendors should treat this campaign as a third-party risk event.

Five CVEs currently listed in the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use — affecting VMware vCenter, Cisco Secure Firewall Management Center, Check Point Security Gateway, Nx Console, and ConnectWise ScreenConnect — align closely with the infrastructure stack typical of the victim profile observed.

Threat Actor Profile — VEXY RANSOMWARE

Analyst Note: The 3-victims-in-5-days cadence, combined with 100% technology-sector concentration, suggests VEXY is running a purpose-built exploitation pipeline — most likely scanning for and exploiting a specific edge-device vulnerability class rather than conducting bespoke intrusions. The simultaneous exploitation of multiple CVE classes in the current threat landscape (below) supports this assessment.

Current Campaign Analysis

Victim Timeline (Leak Site Posts)

Sector & Geographic Concentration

• 100% technology sector — specifically IT solutions providers, network services, and hosting/infrastructure firms.
• Geographic spread (GB/IN/BR) with no linguistic or regional commonality strongly indicates vulnerability-driven victim selection (scan-and-exploit) over phishing-driven targeting.
• Technology providers typically hold credentials, remote access paths, and trust relationships with downstream clients — amplifying the blast radius of each compromise.

Victim Profile

All three victims fit the SMB-to-mid-market technology provider band (estimated 20–250 employees, ~$2M–$50M annual revenue). This size class commonly exhibits:

• Under-resourced security operations (no 24/7 SOC)
• Exposed management interfaces (vCenter, firewall consoles, RMM tools)
• Flat network architectures enabling rapid lateral movement

Posting Frequency & Escalation

Three posts in five days represents a compressed publication cadence. Leak-site posting typically lags initial compromise by days-to-weeks (negotiation window), meaning the underlying intrusions likely occurred in late August / early September 2026, potentially as a single exploitation wave. Expect additional victims from the same wave to surface over the next 2–3 weeks as negotiations fail.

Probable Initial Access Vectors (CISA KEV Correlation)

The following actively exploited CVEs — all confirmed for ransomware use — map directly onto infrastructure typical of technology service providers and should be treated as priority patch/verify items:

Assessment: CVE-2024-1708 (ScreenConnect) and CVE-2026-50751 (Check Point VPN) are the most probable initial access candidates given the victim profile. CVE-2026-59310 (vCenter) is the most probable post-access escalation/destruction vector — vCenter compromise enables mass VM encryption, the highest-impact detonation path.

Detection Engineering

Sigma Rules

The following rules target the pre-encryption phase of VEXY-style intrusions: edge access tool abuse, lateral movement via PsExec/WMI, shadow copy deletion, and data staging.

---
title: Suspicious Remote Access Tool Execution - RMM Abuse
id: 8f3a2b1c-vexy-0001-a1b2-c3d4e5f60001
status: experimental
description: Detects execution of remote access tooling (ScreenConnect, AnyDesk, etc.) from non-standard paths, consistent with ransomware affiliate RMM abuse for persistence and lateral movement.
author: Security Arsenal Threat Intelligence
date: 2026/09/14
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\AnyDesk.exe'
      - '\AteraAgent.exe'
      - '\SplashtopSOS.exe'
  filter_standard_paths:
    Image|startswith:
      - 'C:\Program Files\ScreenConnect'
      - 'C:\Program Files (x86)\ScreenConnect'
      - 'C:\Program Files\AnyDesk'
  condition: selection_img and not filter_standard_paths
falsepositives:
  - Legitimate RMM deployed to non-standard directories
level: high
tags:
  - attack.command_and_control
  - attack.t1219
---
title: Volume Shadow Copy Deletion via Vssadmin or WMIC
id: 8f3a2b1c-vexy-0002-a1b2-c3d4e5f60002
status: experimental
description: Detects deletion of Volume Shadow Copies — near-universal pre-encryption behavior in ransomware operations to inhibit recovery.
author: Security Arsenal Threat Intelligence
date: 2026/09/14
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Win32_ShadowCopy | Remove'
      - 'Get-CimInstance Win32_ShadowCopy'
  condition: 1 of selection_*
falsepositives:
  - Backup maintenance scripts (rare; validate against change windows)
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: Lateral Movement via PsExec Service Creation
id: 8f3a2b1c-vexy-0003-a1b2-c3d4e5f60003
status: experimental
description: Detects PsExec-style lateral movement via service installation with randomized or default PsExec service names on remote hosts.
author: Security Arsenal Threat Intelligence
date: 2026/09/14
logsource:
  product: windows
  service: system
  definition: EventID 7045 - Service installed
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexecsvc'
      - 'remcomsvc'
  selection_random:
    EventID: 7045
    ImagePath|contains:
      - '\ADMIN$\'
      - '\IPC$\'
  condition: selection or selection_random
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ Deploy) — baseline by service name and source host
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002

KQL — Microsoft Sentinel Hunt Query

Hunt for the pre-ransomware staging pattern: new admin-share service execution followed by mass file access and shadow copy tampering within a correlated window. Run over the last 14 days.

// VEXY-style pre-ransomware staging hunt: lateral movement -> staging -> backup destruction
let Lookback = 14d;
let LateralHosts =
    DeviceEvents
    | where Timestamp > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any ("PSEXESVC", "PAExec", "remcomsvc", "csexecsvc")
    | summarize FirstLateral = min(Timestamp) by DeviceName, InitiatingProcessAccountName;
let BackupTamper =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
        or (FileName =~ "wmic.exe" and ProcessCommandLine has_all ("shadowcopy", "delete"))
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled no")
    | summarize BackupTamperTime = min(Timestamp), TamperCommands = make_set(ProcessCommandLine) by DeviceName;
let StagingActivity =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemotePort in (443, 22, 21) and InitiatingProcessName in~ ("rclone.exe", "megasync.exe", "filezilla.exe", "winscp.exe", "curl.exe")
    | summarize ExfilToolSeen = min(Timestamp), ExfilTargets = make_set(RemoteUrl) by DeviceName, InitiatingProcessName;
LateralHosts
| join kind=inner BackupTamper on DeviceName
| join kind=leftouter StagingActivity on DeviceName
| extend LateralToTamperMinutes = datetime_diff("minute", BackupTamperTime, FirstLateral)
| project DeviceName, InitiatingProcessAccountName, FirstLateral, BackupTamperTime, LateralToTamperMinutes, TamperCommands, ExfilTargets
| order by BackupTamperTime asc;

Triage guidance: Any host where LateralToTamperMinutes is under 240 (4 hours) should be treated as an active intrusion in the detonation window — isolate immediately.

PowerShell — Rapid Response Script

Run on suspected hosts or fleet-wide via your RMM/EDR to surface the top pre-encryption indicators in one pass.

# VEXY Rapid Triage: pre-encryption indicator sweep
# Run elevated. Outputs to C:\IR-Triage\vexy-triage-<hostname>-<date>.txt
$out = "C:\IR-Triage"; New-Item -ItemType Directory -Path $out -Force | Out-Null
$report = "$out\vexy-triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"

"=== VEXY RAPID TRIAGE - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $report

"`n[1] Scheduled tasks created in last 7 days (persistence check):" | Out-File $report -Append
Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and $_.TaskPath -notlike "\Microsoft*"
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-Table -AutoSize | Out-File $report -Append

"`n[2] Volume Shadow Copy status (should NOT be empty on servers):" | Out-File $report -Append
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: NO SHADOW COPIES FOUND - possible anti-recovery tampering" | Out-File $report -Append }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table | Out-File $report -Append }

"`n[3] Suspicious services (PsExec/RMM-style lateral movement):" | Out-File $report -Append
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match "PSEXESVC|PAExec|remcomsvc|csexecsvc" -or
    $_.PathName -match "ADMIN\$|AppData.*\.exe|Temp.*\.exe"
} | Select-Object Name, DisplayName, PathName, StartMode, State | Format-Table | Out-File $report -Append

"`n[4] RDP exposure & recent interactive logons (type 3/10):" | Out-File $report -Append
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) { "WARNING: RDP LISTENING - verify NLA + restriction" | Out-File $report -Append }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 2000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match "Logon Type:\s+(3|10)" } |
    Select-Object -First 30 TimeCreated, @{N='Source';E={if ($_.Message -match 'Source Network Address:\s+(\S+)'){$Matches[1]}}} |
    Format-Table | Out-File $report -Append

"`n[5] Data staging / exfil tooling artifacts:" | Out-File $report -Append
$tools = "rclone.exe","megasync.exe","7z.exe","winscp.exe","filezilla.exe"
foreach ($t in $tools) {
    Get-ChildItem -Path "C:\","C:\Users" -Filter $t -Recurse -ErrorAction SilentlyContinue -Depth 4 |
        Select-Object FullName, CreationTime | Format-Table | Out-File $report -Append
}

"`n[6] Recently modified vssadmin/bcdedit execution artifacts (prefetch):" | Out-File $report -Append
Get-ChildItem "C:\Windows\Prefetch" -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match "VSSADMIN|WMIC|BCDEDIT" -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object Name, LastWriteTime | Format-Table | Out-File $report -Append

"`nTriage complete. Review $report immediately." | Out-File $report -Append
Write-Host "Report written to $report" -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

VEXY-style intrusions provide a detection window of hours-to-days between initial access and detonation. Hunt for, in order:

1. Shadow copy deletion (vssadmin delete shadows, bcdedit ... recoveryenabled no) — highest-fidelity pre-detonation signal; treat any occurrence on a server as critical.
2. New services with random names or PsExec-style service creation (Event ID 7045) spreading laterally.
3. RMM tooling appearing outside your sanctioned stack — ScreenConnect, AnyDesk, or similar binaries in %TEMP%, %APPDATA%, or user profiles.
4. Compression/archive staging — large .zip/.7z files created in staging directories (C:\ProgramData, user profiles) shortly before network egress spikes.
5. Mass file access on backup infrastructure — groups target backup consoles (Veeam, etc.) before detonation to destroy recovery capability.

Critical Assets Historically Prioritized for Exfiltration

• Client data and downstream customer records (technology providers hold client IP and PII — double extortion leverage)
• Credential stores — password managers, RMM credential databases, Active Directory dumps (ntds.dit)
• Contracts, financials, and legal documents — the standard leak-site pressure package
• Backup catalogs and configurations — to enable targeted backup destruction

Containment Actions — Ordered by Urgency

1. Isolate affected hosts at the network layer (EDR isolation or switch/VLAN quarantine) — do NOT power off; volatile memory holds key artifacts.
2. Block egress to known exfil tooling endpoints (MEGA, rclone remotes, anonymous file-sharing services) at the proxy/firewall.
3. Force enterprise-wide credential rotation — prioritize domain admin, service accounts, VPN credentials, and any RMM-stored credentials. Assume ntds.dit compromise if lateral movement is confirmed.
4. Disable/quarantine unauthorized RMM instances and audit your sanctioned RMM for rogue agents and sessions.
5. Verify backup integrity from an isolated console — confirm offline/immutable copies exist before any recovery planning.
6. Snapshot virtual infrastructure at the vCenter/storage layer if compromise is suspected but detonation has not occurred — but only AFTER isolating the suspected access path (vCenter compromise invalidates this control).

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV-listed CVEs, prioritizing: CVE-2024-1708 (ScreenConnect — upgrade or decommission if unused), CVE-2026-50751 (Check Point VPN — apply vendor fix; disable IKEv1 if unpatched), CVE-2026-59310 (vCenter — apply Broadcom patch and restrict vCenter management interface to a dedicated management VLAN), CVE-2026-20316 (Cisco FMC).
• Enumerate and audit ALL RMM/RAT tools on your estate. Block execution of unsanctioned remote access tools via AppLocker/WDAC — this single control breaks the most common affiliate playbook.
• Restrict RDP: disable internet-facing RDP entirely; enforce NLA, MFA via VPN/ZTNA gateway, and source-IP allowlisting.
• Deploy the Sigma rules and Sentinel query above and alert on shadow copy deletion as CRITICAL severity.
• Verify immutable/offline backups exist and are restorable — not just that backup jobs report success.

Short-Term (2 Weeks)

• Segment the network — isolate backup infrastructure, vCenter/management planes, and client-data stores onto dedicated VLANs with strict east-west firewalling. Flat networks are why these intrusions become enterprise-wide encryption events.
• Deploy MFA on all remote access paths including VPN, RMM consoles, and backup consoles. Disable legacy IKEv1 VPN profiles where possible.
• Implement application control (WDAC/AppLocker) with a sanctioned-tool allowlist; alert on any deviation.
• Establish 24/7 detection coverage for the pre-encryption TTP chain (service creation → staging → shadow copy deletion). If you lack internal capability, engage managed detection services — the 5–14 day dwell window is only useful if someone is watching.
• Third-party risk review: if you are a technology provider's customer, request attestation of their edge-device patch posture and RMM controls. This campaign demonstrates that your providers are the target.

Assessment Outlook: Given the compressed posting cadence and technology-sector focus, Security Arsenal assesses with moderate confidence that additional VEXY victims from this exploitation wave will appear on the leak site over the next 2–3 weeks. Technology providers and their downstream clients in all regions should operate at heightened alert through the end of September 2026.

This briefing is based on live dark web leak site data collected 2026-09-14. Indicators and assessments will be updated as the campaign evolves.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub