Hackers Weaponize Velociraptor DFIR for Stealthy C2 and Ransomware Deployment

Cybersecurity: Exploitation of Velociraptor for Ransomware Attacks

Threat actors have been utilizing Velociraptor, an open-source digital forensics and incident response tool, to establish command-and-control infrastructure and carry out ransomware attacks.

Huntress analysts have documented several incidents from September to November 2025 where attackers exploited vulnerabilities to gain access and deploy Velociraptor for persistent remote access and lateral movement.

Initial Access Vectors and Exploitation

In three documented incidents, attackers used different entry points that all led to the deployment of Velociraptor. Two incidents involved exploiting the ToolShell vulnerability chain in SharePoint, combining CVE-2025-49706 and CVE-2025-49704 to achieve remote code execution without authentication.

One incident involved an agricultural organization, where attackers bypassed SharePoint security by crafting HTTP requests to execute arbitrary commands through a web shell. Another incident targeted a managed service provider using similar techniques, exploiting unpatched vulnerabilities.

Both SharePoint-related incidents resulted in Velociraptor installation as a Windows service with SYSTEM privileges, providing persistence and administrative capabilities.

The third incident involved the exploitation of Windows Server Update Services (WSUS) through CVE-2025-59287, where malicious MSI packages were delivered, demonstrating how overlooked infrastructure can be a vector for compromise.

Post-Exploitation Tactics and Tool Abuse

Threat actors configured Velociraptor instances to communicate with attacker-controlled Cloudflare tunnel endpoints. This infrastructure overlap suggests potential coordination among threat groups or shared operational infrastructure.

Actors executed Base64-encoded PowerShell commands for network reconnaissance and downloaded additional tools.

Visual Studio Code (code.exe) was repeatedly deployed as a remote tunnel service, leveraging its legitimate tunneling capabilities to establish secondary command-and-control channels.

Analysis of the Warlock ransomware incident revealed operational security failures, suggesting either inexperienced operators or attackers under time pressure.

Infrastructure analysis revealed overlaps across incidents, indicating shared toolkits or coordination between operators leveraging common attack infrastructure.

Based on reporting by GBHackers.