VEXY RANSOMWARE

VEXY RANSOMWARE is an emerging extortion operation first tracked in early September 2026. Public ransomware trackers observed a dedicated Tor leak site and roughly 15–16 victim claims within the first three weeks of activity, with claims spanning India, Brazil, Ecuador, Argentina, Mexico, the United Kingdom, Italy, Japan, the United States and Vietnam. Technology/service providers, manufacturing, retail/e-commerce, hospitality and education appear among the claimed victims. Public technical evidence remains unusually thin: no major vendor has published a validated malware sample, encryption extension, ransom note, decryptor analysis or actor-specific initial-access method. Multiple sources describe the operation as using leak threats and data-publication pressure, so the strongest current characterization is an emerging data-extortion/ransomware-branded actor rather than a technically characterized ransomware family.