Ransomware operators have begun leveraging Velociraptor, an open-source digital forensics and incident response tool, to maintain persistent access within compromised environments. This activity is attributed with moderate confidence to the suspected China-based threat actor Storm-2603, based on overlapping tools and tactics. The campaign targeted VMware ESXi virtual machines and Windows servers, deploying multiple ransomware variants including Warlock, LockBit, and Babuk. The initial access vector was not definitively observed, though the victim’s exposure to specific on-premises vulnerabilities increases the likelihood that exploitation of those flaws provided the entry point. The use of a legitimate security tool for malicious purposes represents a significant shift in operational tradecraft, complicating detection efforts for defenders who rely on standard endpoint monitoring.
The actors installed an outdated version of Velociraptor on multiple servers to establish persistence, exploiting a privilege escalation vulnerability that allowed for arbitrary command execution and endpoint takeover. They also used the tool to download and execute a code editor, likely to create a tunnel to an attacker-controlled command-and-control server. To impair defenses, the group modified Active Directory group policy objects to disable real-time protection, behavior monitoring, and file activity monitoring. A fileless PowerShell script served as the primary encryptor, using AES encryption to target a wide range of file extensions across all drives. The actors also conducted data exfiltration using a separate PowerShell script that suppressed progress indicators and included sleep commands to evade sandbox analysis. This script uploaded files to a remote server using concurrent jobs, ensuring the theft of sensitive documents before encryption was fully deployed.[/subscribe_to_unlock_form]
Ransomware operators have begun leveraging Velociraptor, an open-source digital forensics and incident response tool, to maintain persistent access within compromised environments. This activity is attributed with moderate confidence to the suspected China-based threat actor Storm-2603, based on overlapping tools and tactics. The campaign targeted VMware ESXi virtual machines and Windows servers, deploying multiple ransomware variants including Warlock, LockBit, and Babuk. The initial access vector was not definitively observed, though the victim’s exposure to specific on-premises vulnerabilities increases the likelihood that exploitation of those flaws provided the entry point. The use of a legitimate security tool for malicious purposes represents a significant shift in operational tradecraft, complicating detection efforts for defenders who rely on standard endpoint monitoring.
The actors installed an outdated version of Velociraptor on multiple servers to establish persistence, exploiting a privilege escalation vulnerability that allowed for arbitrary command execution and endpoint takeover. They also used the tool to download and execute a code editor, likely to create a tunnel to an attacker-controlled command-and-control server. To impair defenses, the group modified Active Directory group policy objects to disable real-time protection, behavior monitoring, and file activity monitoring. A fileless PowerShell script served as the primary encryptor, using AES encryption to target a wide range of file extensions across all drives. The actors also conducted data exfiltration using a separate PowerShell script that suppressed progress indicators and included sleep commands to evade sandbox analysis. This script uploaded files to a remote server using concurrent jobs, ensuring the theft of sensitive documents before encryption was fully deployed.[emaillocker id="1283"]
The campaign demonstrates the increasing reliance on commercial and open-source products by ransomware groups to blend in with legitimate security operations. The deployment of multiple ransomware variants in a single attack is highly unusual and serves as a strong indicator for attribution to specific threat actors. The use of Velociraptor for persistence and communication highlights the need for organizations to monitor the behavior of trusted security tools, not just their presence. Defenders should ensure that all security software is kept up to date and that administrative privileges are strictly controlled to prevent the abuse of legitimate utilities for malicious purposes. This trend underscores the evolving nature of ransomware operations and the challenges they pose to traditional detection methods.
We recommend you to refer this link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Resource Development | T1584.003 | Compromise Infrastructure | Virtual Private Server |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Persistence | T1136 | Create Account | - |
| Persistence | T1505.006 | Server Software Component | vSphere Installation Bundles |
| Privilege Escalation | T1098.007 | Account Manipulation | Additional Local or Domain Groups |
| Defense Evasion | T1484.001 | Domain or Tenant Policy Modification | Group Policy Modification |
| Lateral Movement | T1021.002 | Remote Services | SMB/Windows Admin Shares |
| Collection | T1213 | Data from Information Repositories | - |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
| Impact | T1486 | Data Encrypted for Impact | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Impact | E1486 | Data Encrypted for Impact |
| Exfiltration | E1020 | Automated Exfiltration |
| Defense Evasion | F0004 | Disable or Evade Security Tools |
| Defense Evasion | E1112 | Modify Registry |
| Persistence | B0022 | Remote Access |
| Command and Control | B0030 | C2 Communication |
| Communication Micro-objective | C0002 | HTTP Communication |
| Cryptography Micro-objective | C0027 | Encrypt Data |
| File System Micro-objective | C0052 | Writes File |
| File System Micro-objective | C0016 | Create File |
| Execution | E1059 | Command and Scripting Interpreter |
| Anti-Behavioral Analysis | B0025 | Conditional Execution |
The following reports contain further technical details:
[/emaillocker]