Operator dossier

VEXY is a ransomware operator currently active on public leak sites. Darkfield has indexed 36 public victims claimed by this operator between September 4, 2026 and September 29, 2026. VEXY is a ransomware group first observed in September 2026 with an apparent primary motivation of financial gain, though limited public documentation exists given its nascent operational history and small victim footprint. Based on available data, the group has claimed responsibility for attacks against two known victims, with targeting concentrated in Brazil and Ecuador, suggesting a regional focus on Latin American organizations. VEXY has demonstrated interest in the manufacturing and food and beverage sectors, industries that are frequently targeted due to their operational sensitivity and lower tolerance for downtime, which can increase the likelihood of ransom payment. No authoritative attribution regarding country of origin, RaaS affiliation, or technical tooling has been publicly documented by CISA, FBI, Mandiant, or other reputable threat intelligence sources at this time, and the group's attack methodology, encryption implementation, and extortion tactics remain uncharacterized in open-source reporting. Given its very recent emergence and limited victim count, VEXY should be considered an emerging and closely monitored threat, particularly for organizations operating in Latin American manufacturing and food production verticals, though its long-term operational capability and sustainability have yet to be established.

Recent disclosures by VEXY

All 36 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for VEXY →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

VEXY

36 victims indexed · first seen 1 month ago · last activity 14 days ago

Victims indexed

#148 of 410 tracked operators

<1m

Active period

Sep 2026 → Sep 2026

—

Countries hit

At a glance

Status: active
First seen: 1 month ago
Last activity: 14 days ago
Onion sites: 1 known endpoint

About

VEXY is a ransomware group first observed in September 2026 with an apparent primary motivation of financial gain, though limited public documentation exists given its nascent operational history and small victim footprint. Based on available data, the group has claimed responsibility for attacks against two known victims, with targeting concentrated in Brazil and Ecuador, suggesting a regional focus on Latin American organizations. VEXY has demonstrated interest in the manufacturing and food and beverage sectors, industries that are frequently targeted due to their operational sensitivity and lower tolerance for downtime, which can increase the likelihood of ransom payment. No authoritative attribution regarding country of origin, RaaS affiliation, or technical tooling has been publicly documented by CISA, FBI, Mandiant, or other reputable threat intelligence sources at this time, and the group's attack methodology, encryption implementation, and extortion tactics remain uncharacterized in open-source reporting. Given its very recent emergence and limited victim count, VEXY should be considered an emerging and closely monitored threat, particularly for organizations operating in Latin American manufacturing and food production verticals, though its long-term operational capability and sustainability have yet to be established.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/vexy

Recent victims

Loading recent victims

Onion infrastructure

1 known

http://vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion

Source

Updated 14 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time VEXY posts a victim.

Add VEXY to your watchlist — Pro pings you within 5 minutes of any new VEXY leak-site post, Telegram callout, or affiliate-rebrand inference.