Vexy, a new extortion group with 18 postings since September 2026
A previously unknown ransomware actor identified as Vexy began publishing victims on 3 September 2026 and has since listed 18 entries on its leak site, including a French telecoms company. Its rapid publishing pace makes it an emerging threat worth watching.
What happened
On 3 September 2026, a new extortion actor calling itself Vexy published its first entry. Since then, according to the tracking platform RansomLook, the group has posted 18 entries on its leak site, a high tempo for an actor with less than a month of public activity.
Among the most recently reviewed victims is Groupe Proxitel, a French telecommunications company, listed on 29 September 2026. It is important to stress that this is a claim made by the group itself: neither the intrusion nor the scope of any data allegedly stolen has been independently confirmed.
Who the group is
As of today, Vexy is an actor with no known track record. There is no evidence of earlier activity under this or any other name, and its operation shows no clear similarity to already catalogued ransomware families, which makes it hard to attribute it to the rebranding or reshuffling of a previous crew.
It has, however, already been added to MISP Galaxy, the collaborative threat intelligence repository, a sign that the security community formally recognises it as an emerging threat. No verified public information is yet available on its initial access vectors, tooling, or whether it encrypts systems in addition to stealing data.
Why it matters
New groups are usually the hardest to anticipate: there are no consolidated indicators of compromise, no specific detection rules and no known negotiation patterns. The presence of a telecoms operator among the listed victims is also a reminder that service providers can become either an entry point or an impact point for their own customers.
What organisations can do
In the absence of specific indicators, effective defence comes down to the fundamentals, which stop the majority of actors of this type:
- Enforce multi-factor authentication on VPNs, remote access, email and administrative accounts.
- Prioritise patching of internet-facing systems (VPNs, firewalls, file servers and web portals).
- Keep isolated or immutable backups and test full restoration on a regular basis.
- Deploy EDR with active response and centralise logs to detect lateral movement and unusual data transfers.
- Segment the network and keep administrative privileges to the strict minimum.
- Review supplier access rights and incident notification clauses in contracts.
- Update the incident response plan, including notification to the data protection authority if personal data is affected.
About the group: Vexy
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.