Chinese Hackers Employ Velociraptor for New Ransomware Tactics
A cybersecurity threat group known as Storm-2603 has escalated their tactics by exploiting the Velociraptor digital forensics and incident response (DFIR) tool in ransomware attacks. Reported by Cisco Talos, this shift underscores how attackers are increasingly leveraging legitimate tools for illicit access and control over compromised networks.
The Role of Velociraptor in Cyberattacks
Invented by security researcher Michael Cohen and acquired by Rapid7 in 2021, Velociraptor was originally developed to assist incident response teams in monitoring digital environments. However, its recent deployment by attackers illustrates a worrying trend where such tools are being used not for protection but to sustain malign activities. Storm-2603 has been tied to various ransomware exploits including Warlock, LockBit, and Babuk.
Understanding the Attack Methodology
In August 2025, researchers observed Storm-2603 employing Velociraptor to facilitate unauthorized access to victim networks, often by establishing local admin accounts that could connect back to a command-and-control (C2) server. They utilized a vulnerable version of Velociraptor (0.73.4.0) to maintain stealthy and persistent access, thereby deploying multiple ransomware variants simultaneously.
Emerging Risks and Mitigation Strategies
This alarming development raises significant concerns about cybersecurity defenses. Experts highlight the importance of monitoring the use and deployment of Velociraptor within corporate environments and implementing stringent access controls. Companies should examine their systems for unauthorized modifications linked to Velociraptor, ensuring their installations are legitimate and continually reassess their cybersecurity measures to keep pace with evolving threats.
Conclusion: Taking Action Against Ransomware
The emerging presence of Velociraptor in ransomware campaigns illuminates the dynamic nature of cybersecurity threats. Organizations must remain vigilant, continuously improving their defenses against adversaries who do not shy away from turning powerful tools against the very infrastructures meant to safeguard them. By fostering improved cybersecurity practices and awareness, businesses can better prepare themselves against potential attacks.
Write A Comment