Vexy Ransomware — Ransomware Profile
Vexy is a recently emerged extortion crew that operates a Tor based data-leak site. WatchGuard's ransomware tracker records it as first seen in September 2026, classifies its type as a data broker, and lists both direct and double extortion among its methods. The dark web monitoring firm DeXpose has written up several of its listings, including the Brazilian adhesives producer Engefitas and the Indian companies Sancity Soft Touch and Annapurna Fashion, and quotes messages in which the group threatens to publish a full leak unless a company representative makes contact; in the Annapurna Fashion case the message also claimed the victim's files had been encrypted. The group was first observed on its data-leak site in September 2026 and has since claimed at least six organizations in Brazil, Ecuador, India and Mexico, spanning manufacturing, hospitality, transport and retail.
IntelFusions coverage (1)
Recent claimed victims
Read the full analysis on IntelFusions