Velociraptor DFIR Tool Abused in Ransomware Attacks

Threat actors are weaponizing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, in sophisticated multi-variant ransomware campaigns. A group tracked as Storm-2603 reportedly exploits SharePoint vulnerabilities to gain initial access, then deploys an outdated and vulnerable version of Velociraptor to maintain persistence and escalate privileges. The attackers proceed to move laterally, disable security defenses by modifying Group Policy Objects, and exfiltrate data. Subsequently, they encrypt Windows servers and VMware ESXi virtual machines using a combination of Warlock, LockBit, and Babuk ransomware. This campaign is notable for being the first time this actor has been linked to Babuk and for confirming the abuse of Velociraptor in live ransomware incidents.