Vexy Ransomware: New Group With India as Its Top Target

Vexy is a new ransomware group whose leak site appeared at the start of September 2026. In its first three weeks it listed 17 victims — and India had more than any other country, with five, ahead of Brazil and Ecuador (ransomware.live data, 26 September 2026). Victims include technology, retail, manufacturing and hospitality businesses.

No detailed technical analysis of Vexy's encryptor has been published yet, so its encryption method, file extension and way in are not publicly confirmed. What the leak site does show is a double-extortion model: victims are named publicly and threatened with the release of stolen data. We will update this page as reliable analysis appears; until then we would rather say "not known yet" than guess.

Disconnect affected machines from the network, but do not reboot, reinstall or run clean-up tools that delete encrypted files. Keep a copy of the ransom note and a few encrypted sample files, and check whether any backup or storage snapshot survived before anyone touches it.

Because the encryptor is new, an early assessment of sample files is the quickest way to learn whether this variant leaves files partly encrypted — and therefore what can realistically be recovered. In India, a ransomware incident must also be reported to CERT-In within six hours of it being noticed.