Full Report
Huntress reports an uptick in threat actors abusing the Velociraptor open-source DFIR tool, linked to incidents involving WSUS exploitation, VS Code tunnels, and more.
Analysis Summary
# Tool/Technique: Velociraptor (Abused)
## Overview
Velociraptor is a legitimate, open-source Digital Forensics and Incident Response (DFIR) framework designed for endpoint monitoring and information collection. Recently, threat actors have hijacked its robust capabilities—specifically its ability to execute remote commands and collect data—to serve as a Command and Control (C2) agent. By using a trusted security tool, attackers can bypass traditional security perimeters and maintain persistence under the guise of legitimate administrative activity.
## Technical Details
- **Type:** Tool (Dual-use DFIR framework)
- **Platform:** Windows (Targeted in these incidents), Linux, macOS
- **Capabilities:** Remote code execution, endpoint telemetry collection, file system interrogation, and automated artifact hunting.
- **First Seen (in this context):** Significant uptick reported between September and November 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (SharePoint vulnerabilities, WSUS exploitation)
- **[TA0002 - Execution]**
- [T1059.001 - PowerShell] (Encoded commands to download additional tools)
- **[TA0003 - Persistence]**
- [T1543.003 - Windows Service] (Installation of Velociraptor as a system service)
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer] (Use of `msiexec` to fetch MSI payloads)
- [T1572 - Protocol Tunneling] (Use of Cloudflare tunnels and VS Code tunnels)
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact] (Deployment of Warlock ransomware)
## Functionality
### Core Capabilities
- **Remote Monitoring:** Continuous monitoring of endpoint events via VQL (Velociraptor Query Language).
- **Service Installation:** Deploys as a Windows service for persistent access.
- **File Management:** Ability to upload/download files to and from the compromised endpoint.
### Advanced Features
- **Tunneling Integration:** Used in conjunction with Cloudflare Tunnels and Visual Studio Code (`code.exe`) tunnels to bypass firewalls and establish stealthy C2 channels.
- **VQL Execution:** Threat actors can write custom queries to search for sensitive data across the network or execute system-level commands across all infected "clients."
## Indicators of Compromise
- **File Names:**
- `ssh.msi`
- `v3.msi`
- `code.exe` (Visual Studio Code used for tunneling)
- **Network Indicators:**
- `royal-boat-bf05.qgtxtebl.workers[.]dev` (Payload delivery)
- Cloudflare tunnel artifacts (Specific account tags/tokens)
- **Behavioral Indicators:**
- `msiexec.exe` making outbound connections to unconventional `.dev` or Cloudflare worker domains.
- `w3wp.exe` (IIS worker process) or SharePoint processes acting as a parent to `msiexec.exe`.
- Deployment of `Velociraptor` services in environments where the security team does not officially use the tool.
## Associated Threat Actors
- **Storm-2603:** A financially motivated threat cluster previously linked to SharePoint exploitation and Warlock ransomware.
## Detection Methods
- **Signature-based detection:** Monitoring for the Velociraptor binary and service names, though these may be renamed by attackers.
- **Behavioral detection:**
- Identify `msiexec /i` commands pulling from remote URLs instead of local paths.
- Monitor for `w3wp.exe` spawning shells or installation utilities.
- Detect unauthorized Cloudflare (`cloudflared.exe`) or VS Code tunneling activity.
- **Event Log Analysis:** Watch for Event ID 1125 (Windows Defender Network Protection) and Service Control Manager records indicating new, unexpected services.
## Mitigation Strategies
- **Vulnerability Management:** Prioritize patching of public-facing applications like SharePoint and internal infrastructure like Windows Server Update Services (WSUS).
- **Network Segmentation:** Restrict the ability of web servers (like IIS/SharePoint) to initiate outbound connections to the internet, especially via `msiexec`.
- **Application Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unauthorized MSI files or known tunneling tools like `cloudflared`.
## Related Tools/Techniques
- **Visual Studio Code Tunnels:** Used for persistent remote access.
- **OpenSSH:** Installed alongside Velociraptor for alternative access.
- **Cloudflare Workers/Tunnels:** Used to mask C2 traffic and host malicious payloads.