Hackers Turn Velociraptor DFIR Tool Into Weapon in LockBit Ransomware Attacks

Threat actors are abusing Velociraptor, an open-source DFIR tool, in LockBit ransomware attacks that researchers link to Storm-2603 (aka CL-CRI-1040 or Gold Salem), a group already known for deploying Warlock and LockBit ransomware. The weaponisation involved an on-premises SharePoint vulnerability known as ToolShell to gain initial access and deliver an outdated Velociraptor (version 0.73.4.0) that is susceptible to CVE-2025-6264, enabling arbitrary command execution and endpoint takeover, according to Sophos.

In an attack in mid-August 2025, the group reportedly escalated privileges by creating domain admin accounts, moved laterally, and used Smbexec to launch programs remotely via SMB. Before data exfiltration and the dropping of Warlock, LockBit, and Babuk, the adversaries modified AD Group Policy Objects, turned off real-time protection, and aimed to evade detection, linking Storm-2603 to Babuk as well.

Rapid7 has noted that Velociraptor misuse reflects a pattern of repurposing legitimate tooling rather than a software flaw, with Halcyon highlighting ties to Chinese state-sponsored actors due to shared development practices and early ToolShell access.