Velociraptor incident response instrument abused for distant entry – Sophos Information

In August 2025, Counter Menace Unit™ (CTU) researchers investigated an intrusion that concerned deployment of the reputable open-source Velociraptor digital forensics and incident response (DFIR) instrument. On this incident, the risk actor used the instrument to obtain and execute Visible Studio Code with the possible intention of making a tunnel to an attacker-controlled command and management (C2) server. Enabling the tunnel possibility in Visible Studio Code triggered a Taegis™ alert, as this feature can enable each distant entry and distant code execution and has been abused by a number of risk teams prior to now.

The risk actor used the Home windows msiexec utility to obtain an installer (v2.msi) from a Cloudflare Employees area (recordsdata[.]qaubctgg[.]employees[.]dev). This location seems to be a staging folder for attacker instruments, together with the Cloudflare tunneling instrument and the Radmin distant administration instrument. This file put in Velociraptor, which is configured to speak with C2 server velo[.]qaubctgg[.]employees[.]dev. The attacker then used an encoded PowerShell command to obtain Visible Studio Code (code.exe) from the identical staging folder and executed it with the tunnel possibility enabled. The risk actor put in code.exe as a service and redirected the output to a log file. They then used the msiexec Home windows utility once more to obtain extra malware (sc.msi) from the employees[.]dev folder (see Determine 1).

Determine 1: Course of tree exhibiting Velociraptor creating Visible Studio Code tunnel.

The Visible Studio Code tunneling exercise triggered a Taegis alert that prompted a Sophos investigation. The analysts supplied mitigation recommendation that enabled the shopper to rapidly implement remediations similar to isolating the affected host, which prevented the attacker from attaining their targets. Evaluation means that the malicious exercise would possible have led to ransomware deployment.

Menace actors typically abuse distant monitoring and administration (RMM) instruments. In some situations, they leverage preexisting instruments on the focused programs. In others, they deploy the instruments through the assault. The Velociraptor incident reveals attackers pivoting to utilizing incident response instruments to achieve a foothold in a community and reduce the quantity of malware they deploy.

Organizations ought to monitor for and examine unauthorized use of Velociraptor and deal with observations of this tradecraft as a precursor to ransomware. Implementing an endpoint detection and response system, monitoring for surprising instruments and suspicious behaviors, and following greatest practices for securing programs and producing backups can mitigate the ransomware risk. The affect of an assault is significantly diminished whether it is caught previous to ransomware deployment.

The next Sophos protections detect exercise associated to this risk:

• Troj/Agent-BLMR
• Troj/BatDl-PL
• Troj/Mdrop-KDK

To mitigate publicity to this malware, CTU™ researchers suggest that organizations use obtainable controls to evaluation and prohibit entry utilizing the indications listed in Desk 1. The domains might include malicious content material, so think about the dangers earlier than opening them in a browser.

Desk 1: Indicators for this risk.