Cybercriminals Exploit Velociraptor for Covert Operations

In a recent string of cyber incidents, hackers have cleverly turned Velociraptor, an open-source tool originally meant for digital forensics, into a mechanism for launching covert command-and-control operations and ransomware attacks. Analysts at Huntress have uncovered troubling patterns where Velociraptor is used to sustain remote access, sneaking through network defenses like a digital ghost.

From September to November 2025, cyber adversaries have taken advantage of known vulnerabilities to gain network entry and move laterally, all while keeping a low profile. By integrating malicious activities with routine network traffic, these attackers cleverly circumvent typical security measures, making them hard to detect and even harder to stop.

The recurring use of Velociraptor in these episodes highlights a sophisticated shift in cyberattack strategies, using trusted tools to cloak nefarious actions in the guise of legitimate operations.

Entry Points and Exploitation Strategies

Three serious incidents spotlight how Velociraptor was used after leveraging different network entry points. Notably, vulnerabilities dubbed ToolShell (CVE-2025-49706 and CVE-2025-49704) allowed attackers to exploit SharePoint servers without authentication. This method enabled them to infiltrate agricultural and managed services entities, installing Velociraptor for sustained control.

Additionally, a separate breach demonstrated attackers exploiting a Windows Server Update Services flaw (CVE-2025-59287) to sneak in the Warlock ransomware. These incidents emphasize the criticality of keeping software updated and protected against potential exploits.

Operational Tactics and Tool Misuse

Once inside the systems, attackers configured Velociraptor to communicate with their own covert command channels. Connections to infrastructures associated with notable threat groups like Storm-2603 were observed, suggesting shared tools or collaborative skirmishes among cybercriminal factions.

Interestingly, by repurposing legitimate services like Visual Studio Code’s tunneling features, attackers could form resilient secondary control routes, staying under the radar of vigilant security personnel. Despite some operational errors, these incidents reveal a growing trend of tool misuse and infrastructure sharing among well-resourced attackers.

In conclusion, the insidious adaptation of Velociraptor by cybercriminals underscores the need for organizations to enhance their defenses against sophisticated exploits. Keeping systems updated and actively monitored can prevent these threats from escalating into wider network compromise.

**Stay vigilant in the ever-evolving digital landscape. Consider using Qsentinel for real-time monitoring and cybersecurity insights that keep your systems secure.**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.