Full Report
Huntress reports an uptick in threat actors abusing the Velociraptor open-source DFIR tool, linked to incidents involving WSUS exploitation, VS Code tunnels, and more.
Analysis Summary
# Tool/Technique: Velociraptor (Abuse)
## Overview
Velociraptor is a legitimate, open-source Digital Forensics and Incident Response (DFIR) framework designed for endpoint monitoring and hunting. Recently, threat actors have begun repurposing the tool as a persistent Command and Control (C2) agent. Because it is a powerful, signed, and legitimate security tool, its presence often evades traditional detection mechanisms that focus on known malware.
## Technical Details
- **Type:** Tool (Dual-use DFIR framework)
- **Platform:** Windows (Windows Server, SharePoint environments, etc.)
- **Capabilities:** Remote shell access, file system interrogation, memory analysis, forensic artifact collection, and automated response actions.
- **First Seen (in this context):** Notable uptick reported between September and November 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (SharePoint vulnerabilities, WSUS exploitation)
- **[TA0003 - Persistence]**
- [T1543.003 - Create or Modify System Process: Windows Service] (Installing Velociraptor as a service)
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer] (Downloading MSIs via `msiexec`)
- [T1071.001 - Application Layer Protocol: Web Protocols] (C2 over HTTPS)
- [T1572 - Protocol Tunneling] (Use of Cloudflare tunnels and VS Code tunnels)
- **[TA0005 - Defense Evasion]**
- [T1202 - Indirect Command Execution] (Abuse of `msiexec.exe`)
- [T1564 - Hide Artifacts] (Using legitimate DFIR tools to blend in)
## Functionality
### Core Capabilities
- **Endpoint Telemetry:** Continuous monitoring of endpoint events.
- **VQL (Velociraptor Query Language):** Allows attackers to write complex queries to search for data, exfiltrate files, or execute commands across all infected hosts simultaneously.
- **Remote File Management:** Ability to upload and download files to/from the target.
### Advanced Features
- **Tunneling Integration:** Leveraging Cloudflare (Argo) tunnels or VS Code tunnels to bypass firewalls and hide C2 traffic.
- **Scalability:** Designed to manage thousands of endpoints, making it highly effective for large-scale enterprise intrusions.
## Indicators of Compromise
- **File Hashes:**
- *Note: Specific hashes for the malicious MSIs (ssh.msi, v3.msi) were not provided in the snippet, but they are often unique to the attacker's build.*
- **File Names:**
- `ssh.msi`
- `v3.msi`
- `code.exe` (Visual Studio Code used for tunneling)
- **Registry Keys:**
- `HKLM\System\CurrentControlSet\Services\Velociraptor`
- **Network Indicators:**
- `royal-boat-bf05.qgtxtebl.workers[.]dev` (Download source)
- `*.trycloudflare[.]com` (Commonly used for tunnels)
- **Behavioral Indicators:**
- `msiexec.exe` making outbound connections to unusual `.dev` or `.workers.dev` domains.
- `w3wp.exe` (IIS/SharePoint) spawning `msiexec.exe`.
- Encoded PowerShell commands downloading executables from external sources.
## Associated Threat Actors
- **Storm-2603:** A financially motivated threat cluster associated with Warlock ransomware.
- **Unnamed Clusters:** Actors targeting agriculture and MSP environments.
## Detection Methods
- **Signature-based detection:** Monitoring for the Velociraptor executable in unauthorized environments. Although legitimate, its presence on standard workstations or non-security servers is a high-fidelity alert.
- **Behavioral detection:**
- Alerting on `msiexec /i` commands pulling from public cloud workers or code repositories.
- Detecting `w3wp.exe` or `spcmd.exe` (SharePoint) spawning installer processes.
- Monitoring for unauthorized Cloudflare or VS Code tunnel creation (`code.exe tunnel`).
- **YARA:** Target the Velociraptor configuration file structure (typically YAML) embedded in the binary or dropped on disk.
## Mitigation Strategies
- **Vulnerability Management:** Patch SharePoint (CVE-2023-24955 / CVE-2023-29357) and WSUS instances immediately.
- **Network Hardening:** Restrict outbound HTTPS traffic for servers to known-good update/API endpoints. Block known tunneling domains (e.g., `*.trycloudflare.com`).
- **Application Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unauthorized MSI files and tools like `code.exe` on production servers.
## Related Tools/Techniques
- **VS Code Tunnels:** Used for persistent remote access.
- **Cloudflare Tunnels:** Used to mask C2 infrastructure.
- **OpenSSH:** Installed alongside Velociraptor for redundant remote access.
- **ToolShell:** A vulnerability previously linked to similar initial access patterns.