How Ransomware Groups Exploit Velociraptor

Imagine a tool designed to protect your data being used against you. That’s what’s happening with Velociraptor, an open-source tool for digital forensics and incident response. Ransomware groups have discovered a way to exploit this tool, turning its protective capabilities into a weapon against companies. Cisco Talos recently highlighted this concerning trend, noting how cybercriminals reach into trusted toolkits to slip past corporate defenses.

Velociraptor works by deploying lightweight agents to monitor endpoints. However, attackers are using an older, vulnerable version of Velociraptor (v0.73.4.0) to rise above normal access levels. A flaw labeled CVE-2025-6264 allows them to run commands with top-level permissions, slipping through security without raising alarms. In doing so, they can disable important defenses and neatly sidestep detection.

Blended Ransomware Tactics

Once inside, the hackers have shown their hand with an array of ransomware tools, striking both VMware ESXi virtual machines and Windows servers. Among the culprits are Warlock, LockBit, and Babuk ransomware strains. This multi-pronged approach, thought to be the work of Storm-2603, highlights a sophisticated playbook aimed at maximum disruption.

On top of encrypting data, hackers executed scripts to exfiltrate sensitive data like Office documents. They cleverly masked their actions using randomized intervals and kept outputs hidden, making detection challenging for security teams. Analysts believe these tactics bear the hallmark of Storm-2603, a well-known threat actor with roots in China.

Strategies to Counteract Ransomware Threats

To safeguard against these threats, keeping Velociraptor up to date is crucial. Regular audits to catch unauthorized installations, alongside tackling CVE-2025-6264 vulnerabilities, will help seal entry points. It’s important for security teams to stay vigilant about any abnormal command-line actions that might hint at misuse.

Implementing strong endpoint detection and response systems is another strategic move. These systems need to distinguish between legitimate and malicious Velociraptor activities swiftly. Scrutinizing activity in scheduled tasks and Group Policy should be standard procedure, offering early warning signs if something is amiss.

For more in-depth insights, Cisco Talos’ ransomware guidelines and community forums can provide additional advice on mastering Velociraptor’s intended use while thwarting attempts to turn it rogue.

—

For continuous updates on cybersecurity and data protection, visit Qsentinel. Protecting your digital world, one byte at a time.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.