Chinese Hackers Use Velociraptor IR Tool in Ransomware Attacks

Storm-2603, a China-based threat group, has added Velociraptor, a DFIR tool, to its ransomware workflow, using it to maintain stealthy, persistent access as part of attacks that deployed Warlock ransomware alongside other family members. Cisco Talos notes that the campaign began with SharePoint exploitation in July and expanded in August to targeting VMware ESXi servers with Warlock, LockBit and Babuk, illustrating a shift in strategy with Velociraptor now aiding the intrusion.

Velociraptor was installed with an outdated binary (version 0.73.4.0) that leveraged a privilege escalation vulnerability (CVE-2025-6264) to enable arbitrary command execution and endpoint takeover, according to the researchers. Sophos CTU members have linked the Storm-2603 activity to prior Velociraptor abuse observed in August, and Rapid7 has published guidance on detecting and mitigating Velociraptor misuse, noting that Velociraptor’s open-source nature can be exploited or signed by others.

According to Cisco Talos, Velociraptor played a significant role in this campaign by facilitating ongoing access while ransomware was deployed, with detection and mitigation guidance emphasising checks for illegitimate Velociraptor instances and suspicious “velociraptor.exe” services or tasks. 10 October 2025.