Threat Actors Exploit Velociraptor Incident Response Tool for Remote Access

Sophos’ Counter Threat Unit (CTU) researchers uncovered a sophisticated intrusion in which threat actors repurposed the legitimate open-source Velociraptor incident response tool to gain unauthorized remote access within targeted networks.

Velociraptor was deployed to download and execute Visual Studio Code, enabling a tunneling mechanism that connected to an attacker-controlled C2 server, velo.qaubctgg.workers[.]dev, after the Windows msiexec installer fetched v2.msi from a Cloudflare Workers domain files[.]qaubctgg[.]workers[.]dev.

Once installed, code.exe ran with tunneling enabled and Velociraptor was configured to communicate with the C2 domain, with a further msiexec download via sc.msi from the same staging infrastructure to extend the intrusion. The activity formed a process tree with Velociraptor as the parent, and the Taegis security platform alerted to the tunneling, allowing a rapid Sophos investigation that provided mitigation guidance including host isolation and prevented likely ransomware deployment.

According to Sophos, this approach illustrates a broader trend of abusing remote monitoring and management tools to minimise malware footprints and pivot within networks. The campaign tools included Cloudflare tunneling utilities and the Radmin remote administration tool, and Sophos detections such as Troj/Agent-BLMR, Troj/BatDl-PL, and Troj/Mdrop-KDK help identify related threats.