GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

A sophisticated cybercriminal group has been observed repurposing a legitimate digital forensics tool as a precursor for ransomware attacks, according to the CTU Research Team at Sophos. The group, tracked as GOLD SALEM, is using the open-source Velociraptor tool to facilitate intrusions that ultimately deploy the Warlock ransomware. Velociraptor is used to execute malicious commands after downloading from attacker-controlled subdomains on workers[.]dev, with installers often named v2.msi or v3.msi.

In one August intrusion described, a compromised SharePoint process spawned an installer that fetched the malicious Velociraptor payload directly from an attacker’s Cloudflare Worker domain, illustrating a rapid chaining of ToolShell exploitation with post‑compromise tooling. The ransomware toolkit observed includes Warlock, LockBit 3.0, and Babuk variants, suggesting a diversified approach beyond simple profit.

CTU researchers link GOLD SALEM to a China-based threat cluster Microsoft tracks as Storm-2603, while noting indicators that align with tactics used by Chinese threat actors.