Velociraptor incident response software abused for distant entry – Sophos Information

In August 2025, Counter Risk Unit™ (CTU) researchers investigated an intrusion that concerned deployment of the reliable open-source Velociraptor digital forensics and incident response (DFIR) software. On this incident, the risk actor used the software to obtain and execute Visible Studio Code with the doubtless intention of making a tunnel to an attacker-controlled command and management (C2) server. Enabling the tunnel choice in Visible Studio Code triggered a Taegis™ alert, as this feature can permit each distant entry and distant code execution and has been abused by a number of risk teams up to now.

The risk actor used the Home windows msiexec utility to obtain an installer (v2.msi) from a Cloudflare Employees area (information[.]qaubctgg[.]employees[.]dev). This location seems to be a staging folder for attacker instruments, together with the Cloudflare tunneling software and the Radmin distant administration software. This file put in Velociraptor, which is configured to speak with C2 server velo[.]qaubctgg[.]employees[.]dev. The attacker then used an encoded PowerShell command to obtain Visible Studio Code (code.exe) from the identical staging folder and executed it with the tunnel choice enabled. The risk actor put in code.exe as a service and redirected the output to a log file. They then used the msiexec Home windows utility once more to obtain further malware (sc.msi) from the employees[.]dev folder (see Determine 1).

Determine 1: Course of tree displaying Velociraptor creating Visible Studio Code tunnel.

The Visible Studio Code tunneling exercise triggered a Taegis alert that prompted a Sophos investigation. The analysts offered mitigation recommendation that enabled the client to rapidly implement remediations comparable to isolating the affected host, which prevented the attacker from reaching their goals. Evaluation means that the malicious exercise would doubtless have led to ransomware deployment.

Risk actors typically abuse distant monitoring and administration (RMM) instruments. In some situations, they leverage preexisting instruments on the focused techniques. In others, they deploy the instruments in the course of the assault. The Velociraptor incident reveals attackers pivoting to utilizing incident response instruments to achieve a foothold in a community and reduce the quantity of malware they deploy.

Organizations ought to monitor for and examine unauthorized use of Velociraptor and deal with observations of this tradecraft as a precursor to ransomware. Implementing an endpoint detection and response system, monitoring for surprising instruments and suspicious behaviors, and following greatest practices for securing techniques and producing backups can mitigate the ransomware risk. The impression of an assault is enormously diminished whether it is caught previous to ransomware deployment.

The next Sophos protections detect exercise associated to this risk:

• Troj/Agent-BLMR
• Troj/BatDl-PL
• Troj/Mdrop-KDK

To mitigate publicity to this malware, CTU™ researchers advocate that organizations use obtainable controls to evaluation and prohibit entry utilizing the indications listed in Desk 1. The domains might comprise malicious content material, so take into account the dangers earlier than opening them in a browser.

Desk 1: Indicators for this risk.