Cybercriminals Leverage Velociraptor in Ransomware Attacks

In a concerning twist, cybercriminals are now using the Velociraptor digital forensics and incident response (DFIR) tool in their ransomware operations. Their primary targets are systems plagued with LockBit and Babuk malware, underlining the adaptive nature of these cyber threats. According to research from Cisco Talos, medium confidence is placed on a China-based group, Storm-2603, for orchestrating these malicious campaigns.

Velociraptor, an open-source tool developed by Mike Cohen and now under Rapid7, is intended for legitimate forensic tasks but is being misused for unauthorized access. Reports highlight how criminals are deploying Visual Studio Code on compromised systems to establish stealthy communication with command and control (C2) servers. Interestingly, Storm-2603 is also linked to state-sponsored Chinese hackers, associated with the Warlock ransomware, and collaborates with LockBit.

Infiltration Tactics and Persistence

The attackers exploited a vulnerability in an outdated Velociraptor version (CVE-2025-6264) for privilege escalation, enabling ongoing unauthorized system control. By creating local admin accounts synced with Entra ID, they maintained access to VMware vSphere consoles. This vulnerability facilitated arbitrary command execution, granting extensive system control.

These tactics included executing Impacket commands for remote application launches and scheduling batch scripts. Through modifying Active Directory Group Policies, they bypassed Windows Defender’s real-time protection. Ransomware identified as LockBit left files encrypted with a “.xlockxlock” extension, a Warlock ransomware hallmark. On VMware ESXi, Babuk ransomware was also detected.

A PowerShell encryptor generating AES keys was utilized for mass data encryption, while another script exfiltrated files, employing delays to bypass detection systems. Cisco Talos has released indicators of compromise (IoCs) detailing the uploaded malicious files.

For further updates on cybersecurity threats, vulnerabilities, and emerging trends, stay informed by following our latest reports.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.