Full Report
Huntress has seen an uptick in threat actors abusing the Velociraptor open-source DFIR tool in a range of attacks, including a recent incident involving WSUS exploitation.
Analysis Summary
# Tool/Technique: Velociraptor Misuse (via WSUS Exploitation)
## Overview
Velociraptor is a legitimate, open-source Digital Forensics and Incident Response (DFIR) framework designed for endpoint monitoring and artifact collection. Recently, threat actors have begun abusing its powerful remote execution and monitoring capabilities to serve as a persistent Command and Control (C2) agent following initial exploitation.
## Technical Details
- **Type:** Tool (Dual-use/Abused DFIR Tool)
- **Platform:** Windows (specifically observed on Windows Server via WSUS)
- **Capabilities:** Remote artifact collection, file system interaction, remote shell access, and persistent monitoring.
- **First Seen:** Huntress noted an uptick starting November 2024; significant increase in misuse throughout early 2025.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (WSUS CVE-2025-59287)
- **TA0003 - Persistence**
- T1543.003 - Create or Modify System Process: Windows Service
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer (Downloading MSI via S3)
- T1219 - Remote Access Software
## Functionality
### Core Capabilities
- **Endpoint Telemetry:** Rapid collection of forensic artifacts across an entire fleet.
- **VQL (Velociraptor Query Language):** Allows for complex, custom queries to monitor or search for specific file system and registry changes.
- **Remote C2:** In its misused state, it provides actors with a reliable, encrypted channel to execute commands and exfiltrate data.
### Advanced Features
- **Low Footprint:** As a legitimate tool, it may bypass some basic security controls that look for known malicious signatures.
- **Scalability:** Built to manage thousands of endpoints, making it highly effective for wide-scale post-exploitation activity.
## Indicators of Compromise
- **File Hashes (MSI Package):** (Specific SHA256 not provided in text, but identified as `v4.msi`)
- **File Names:**
- `Velociraptor.exe`
- `client.config.yaml`
- `v4.msi`
- **Network Indicators:**
- `s3[.]wasabisys[.]com/kiessler/v4.msi` (Source of malicious installer)
- `update[.]githubtestbak[.]workers[.]dev` (C2 endpoint/Velociraptor server)
- **Behavioral Indicators:**
- Deployment via `MsiInstaller` following `WSUSService.exe` crashes or anomalies.
- New service creation: `Velociraptor Service`.
- Execution of `Velociraptor.exe` with the `--config` and `service run` flags.
## Associated Threat Actors
- **Storm-2603** (Linked by Cisco Talos with medium confidence).
- Unnamed actors exploiting **CVE-2025-59287** (WSUS RCE).
## Detection Methods
- **Signature-based detection:** Monitoring for the Velociraptor binary in unauthorized directories (e.g., outside of known DFIR workflows).
- **Behavioral detection:**
- Identifying the `service run` command line argument for `Velociraptor.exe`.
- Monitoring for unauthorized Windows Service creation (Event ID 7045).
- Monitoring WSUS logs for deserialization errors or unexpected `WSUSService.exe` child processes.
- **Log Monitoring:** Look for MSI installation events targeting `C:\Program Files\Velociraptor`.
## Mitigation Strategies
- **Patch Management:** Immediately apply Microsoft patches for **CVE-2025-59287** to protect WSUS instances.
- **Network Segmentation:** Ensure WSUS servers are not exposed directly to the public internet on default ports.
- **Service Hardening:** Limit the ability of service accounts to perform unauthorized installations or reach out to external S3 buckets/Cloudflare workers.
- **Application Whitelisting:** Prevent the execution of dual-use tools like Velociraptor unless they are deployed by authorized IT/Security staff.
## Related Tools/Techniques
- **WSUS Exploitation:** Using centralized update services to push malicious payloads.
- **ScreenConnect / Bomgar:** Other legitimate RMM tools recently abused for persistence.
- **ToolShell:** SharePoint vulnerability previously linked to similar actor behavior.