Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling

Cybersecurity researchers highlighted a campaign where unknown threat actors abused the open‑source endpoint monitoring and digital forensic tool Velociraptor to download and execute Visual Studio Code, with the apparent aim of creating a tunnel to an attacker‑controlled command‑and‑control server.

The attackers used the Windows msiexec utility to fetch an MSI installer from a Cloudflare Workers domain, which installs Velociraptor and then contacts another Cloudflare Workers domain, enabling the download of Visual Studio Code from the same staging server via an encoded PowerShell command and launching the tool with the tunnel option. The same msiexec process was observed downloading additional payloads from the workers[.]dev folder, suggesting a staged approach to accessing and controlling victim systems.

According to Sophos Counter Threat Unit Research Team, organisations should monitor for unauthorized use of Velociraptor and treat observations of this tradecraft as a precursor to ransomware, recommending endpoint detection and response, monitoring for unexpected tools and suspicious behaviours, and robust backups as mitigations. While living‑off‑the‑land techniques are common, the use of Velociraptor signals a tactical evolution in incident response tools being repurposed for footholds.