Threat Actors Leverage Velociraptor DFIR Tool for Stealthy C2 & Ransomware Delivery

Du'aine Davis

Observed in the wild

• Threat actors have increasingly abused Velociraptor, a legitimate DFIR tool, for stealthy command-and-control (C2) and lateral movement. Recent campaigns (observed from late summer through November 2025) targeted organisations via compromised WSUS servers and other exposed services, with activity linked to groups such as Storm-2603. These incidents represent a surge compared to prior misuse noted in 2024.
• Attackers exploited WSUS deserialization flaws (CVE-2025-59287) and likely SharePoint vulnerabilities (ToolShell) to gain initial access. They deployed Velociraptor using malicious MSI installers, then executed base64-encoded PowerShell commands for system discovery and persistence. This approach mirrors a trend of leveraging trusted tools to evade detection and reduce malware footprint.
• Organisations should treat unexpected Velociraptor activity as a high-risk indicator. Recommended actions include:
  • Enable Microsoft Defender for Endpoint to detect anomalous MSI installs and encoded PowerShell execution.
  • Apply ASR rules to block suspicious script behaviours and enforce application control.
  • Monitor for Velociraptor service creation and outbound connections to domains like *.workers.dev.
  • Patch WSUS and SharePoint promptly, isolate affected systems, and review EDR telemetry for lateral movement signals.

Velociraptor WSUS Exploitation, Pt. I: WSUS-Up? | Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress