Understanding the Misuse of Velociraptor in Ransomware Attacks

In a turn of events that’s raising eyebrows in the cybersecurity world, Velociraptor, an open-source tool primarily used for digital forensics and incident response, has found itself in the wrong hands. A group known as Storm-2603, hailing from China and notorious for exploits targeting Microsoft SharePoint, has reportedly turned this tool against its intended purpose. The misuse was first flagged by the astute folks at Cisco Talos back in August 2025 during an intricate ransomware investigation.

Cisco Talos uncovered a web of tactics indicating the fingerprints of Warlock ransomware. The attackers cunningly repurposed Velociraptor to deploy various ransomware forms including Warlock, LockBit, and Babuk, focusing their attacks on both VMware ESXi virtual machines and Windows servers. These moves significantly disrupted the victim organization’s operations. It’s clear that leveraging Velociraptor marked a critical escalation in these infiltration techniques.

The Evolving Threat Landscape

The diabolical twist here lies in Storm-2603’s use of an outdated Velociraptor, plagued by vulnerabilities that they adeptly exploited to gain elevation of privileges. Reports by Sophos indicated that compromised Velociraptor agents were manipulated to download additional tools, effectively aiding in covert operations through command-and-control servers. This technique ensured they maintained a stealthy presence, even in attempts to contain their initial invasion.

Talos is confident in linking these cyber antics to Storm-2603, noted for disabling security defenses and using command-line prowess in their attacks. The introduction of Babuk ransomware signals a new chapter in their criminal playbook, highlighting a trend where cybercriminals diversify their tactics and tools. In light of these events, experts urge organizations to vigilantly monitor their Velociraptor versions, updating to at least version 0.73.5 to patch known vulnerabilities, like CVE-2025-6264. Constant vigilance and comprehensive security measures are more crucial than ever in this evolving landscape.

Qsentinel recommends regular updates and proactive security measures. Stay protected; stay informed.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.