DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks

Cisco Talos has confirmed that ransomware operators are now abusing Velociraptor, an open-source DFIR tool, in live campaigns, with the August 2025 operation tying together Warlock, LockBit and Babuk in a single assault. Velociraptor was deployed in an outdated 0.73.4[.]0 version that contained a privilege-escalation vulnerability (CVE-2025-6264), enabling arbitrary command execution and endpoint takeover, according to Cisco Talos.

The attackers allegedly used Velociraptor to maintain stealthy persistence while delivering additional payloads, including LockBit and Babuk, a technique Talos says ensured persistent access during deployment. The campaign, attributed with moderate confidence to Storm-2603, targeted VMware ESXi virtual machines and Windows servers during August 2025, encrypting both physical and virtual infrastructure and using Velociraptor for ongoing control.

A PowerShell-based exfiltration script also uploaded stolen data to 65.38.121[.]226 while suppressing logs to hinder detection. The researchers noted that Babuk ransomware files had appeared in this operation, suggesting ongoing experimentation within Storm-2603’s playbook.