Threat Actors Exploit DFIR Tool Velociraptor in Ransomware Attacks
Cisco Talos has verified that ransomware operators are utilizing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, to gain covert, persistent access and deploy various ransomware variants in enterprise environments.
Cisco Talos has verified that ransomware operators are utilizing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, to gain covert, persistent access and deploy various ransomware variants in enterprise environments.
This represents the initial confirmed connection between Velociraptor and ransomware operations, highlighting a trend where threat actors incorporate legitimate security tools into their strategies.
Velociraptor facilitates continuous endpoint monitoring across Windows, Linux, and macOS systems by employing lightweight client agents. In the documented campaign, attackers installed an outdated version of Velociraptor (v0.73.4.0) on compromised systems, exploiting a privilege escalation vulnerability (CVE-2025-6264) to execute arbitrary commands with SYSTEM privileges.
This vulnerability allowed attackers to maintain undetected access even after systems were isolated by security teams. By deploying Velociraptor without triggering security alerts, the attackers carried out reconnaissance commands, manipulated scheduled tasks, and disabled critical Microsoft Defender features to avoid detection.
After initial access, the threat actors deployed Warlock, LockBit, and Babuk ransomware across VMware ESXi virtual machines and Windows servers. Warlock ransomware, identified in June 2025, appends the extension ".xlockxlock" to encrypted files. Concurrently, a Babuk binary targeted ESXi hosts, appending ".babyk" to partially encrypted files. The deployment of distinct ransomware families in a single attack suggests orchestration by the threat actor Storm-2603.
Velociraptor facilitates continuous endpoint monitoring across Windows, Linux, and macOS systems by employing lightweight client agents.
For data exfiltration, the attackers executed a PowerShell script to gather Office documents under 50 MB and upload them via HTTP PUT requests to a remote server. The script used $ProgressPreference = 'SilentlyContinue' to suppress output and incorporated randomized sleep intervals to evade sandbox analysis.
Cisco Talos attributes this campaign with moderate confidence to the China-based threat actor Storm-2603, initially identified exploiting SharePoint ToolShell vulnerabilities in July 2025. Indicators include overlapping techniques such as cmd.exe batch scripts, scheduled tasks, IIS component manipulation, and Group Policy Object modifications, alongside the deployment of both Warlock and LockBit ransomware.
Mitigation and Defensive Recommendations
Organizations should ensure Velociraptor agents are updated to the latest secure versions and audited for unauthorized installations. Patching CVE-2025-6264 and known ToolShell vulnerabilities on on-premises SharePoint servers is crucial.
Security teams should monitor for unexpected Velociraptor client activity, especially installations initiated via msiexec /q /i commands from untrusted URLs. Implementing robust endpoint detection and response solutions that can differentiate legitimate from malicious Velociraptor activity is essential.
Regular reviews of scheduled tasks, Group Policy changes, and PowerShell script executions for abnormal patterns will help identify early compromise signs. For further guidance, refer to Cisco Talos' Ransomware Primer and ToolShell patching recommendations.
Based on reporting by GBHackers.