Threat Actors Exploit DFIR Tool Velociraptor in Ransomware Attacks

According to Cisco Talos, threat actors have begun exploiting Velociraptor, an open-source DFIR tool, to gain stealthy, persistent access and deploy multiple ransomware variants against enterprise environments, marking the first definitive linkage between Velociraptor and ransomware operations.

The campaign saw adversaries installing an outdated Velociraptor version (v0.73.4.0) on compromised hosts, exploiting a privilege escalation vulnerability (CVE-2025-6264) to execute arbitrary commands as SYSTEM, enabling long-term access even after hosts were isolated. The attackers used Velociraptor without triggering alarms to run reconnaissance commands, manipulate scheduled tasks, and disable Microsoft Defender features to avoid detection.

Following initial access, they deployed Warlock, LockBit, and Babuk ransomware across VMware ESXi virtual machines and Windows servers, with Warlock appending “.xlockxlock” to encrypted files and Babuk targeting ESXi with files appended by “.babyk”. To exfiltrate data for double-extortion, a PowerShell script recursively gathered Office documents under 50 MB and uploaded them via HTTP PUT to a remote server, while employing sleep intervals and silent progress to hamper analysis.

Patching CVE-2025-6264 and ToolShell vulnerabilities on on-premises SharePoint servers is highlighted as essential, along with monitoring Velociraptor installations and robust endpoint detection.