MalwarePublished 9 Oct 2025

Hackers now use Velociraptor DFIR tool in ransomware attacks

Source Reddit InfoSec News

Description

Threat actors have begun leveraging the Velociraptor digital forensics and incident response (DFIR) tool as part of ransomware attack campaigns. Velociraptor, originally designed for legitimate forensic investigations and incident response, is being repurposed by attackers to facilitate lateral movement, reconnaissance, and data collection within compromised networks. This misuse enhances attackers' ability to identify valuable targets and escalate privileges before deploying ransomware payloads. The threat is considered high severity due to the tool's powerful capabilities, ease of use, and the significant impact ransomware attacks can have on confidentiality, integrity, and availability of systems. European organizations, especially those with critical infrastructure and large enterprise environments, face increased risk given the tool’s effectiveness in complex networks. Mitigation requires tailored detection of Velociraptor usage patterns, strict endpoint monitoring, and network segmentation to limit attacker movement. Countries with high adoption of enterprise IT infrastructure and critical sectors such as finance, manufacturing, and government are most likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the potential for widespread disruption, ease of exploitation by skilled attackers, and the critical nature of impacted assets.

Impact

The misuse of Velociraptor in ransomware attacks can lead to significant impacts on European organizations. Confidentiality is at risk as attackers can exfiltrate sensitive data using Velociraptor’s data collection features. Integrity may be compromised through unauthorized changes to system configurations and deployment of ransomware payloads. Availability is threatened by ransomware encryption of critical systems and data, potentially causing operational downtime and financial losses. The tool’s legitimate nature makes detection challenging, increasing dwell time and the likelihood of successful attacks. European sectors such as finance, healthcare, manufacturing, and government are particularly vulnerable due to their reliance on complex IT environments and critical data. The threat also raises concerns for incident response teams, as attackers’ use of forensic tools can confuse attribution and delay remediation. Overall, the impact includes operational disruption, reputational damage, regulatory penalties, and increased incident response costs.

Defensive guidance

To mitigate this threat, European organizations should implement advanced endpoint detection and response (EDR) solutions capable of identifying unusual use of legitimate forensic tools like Velociraptor. Establish strict access controls and least privilege principles to limit who can deploy and operate such tools within the network. Monitor network traffic for anomalous queries and remote execution patterns consistent with Velociraptor activity. Employ network segmentation to restrict lateral movement opportunities and isolate critical assets. Conduct regular threat hunting exercises focused on detecting misuse of administrative and forensic tools. Maintain up-to-date inventories of authorized software and promptly investigate any unauthorized installations. Enhance user and entity behavior analytics (UEBA) to detect deviations from normal administrative activities. Provide targeted training for security teams to recognize signs of Velociraptor misuse. Finally, develop and test incident response plans that specifically address scenarios involving legitimate tool abuse in ransomware attacks.

Summary

Velociraptor is an open-source endpoint monitoring and digital forensics tool widely used by security professionals for incident response and threat hunting. Recently, threat actors have started abusing Velociraptor within ransomware campaigns to enhance their operational capabilities. By deploying Velociraptor on compromised endpoints, attackers gain advanced visibility into network topology, running processes, and system configurations, enabling them to identify high-value targets and escalate privileges stealthily. This tool facilitates lateral movement by allowing attackers to execute queries and scripts remotely, collect sensitive data, and maintain persistence. Unlike traditional malware, Velociraptor’s legitimate functionality helps attackers evade detection by blending in with normal administrative activities. The use of Velociraptor in ransomware attacks represents a shift towards leveraging legitimate tools for malicious purposes, complicating detection and response efforts. Although no specific exploits or vulnerabilities in Velociraptor itself are reported, its misuse in active ransomware campaigns increases the threat landscape. The high severity rating reflects the combination of Velociraptor’s powerful capabilities and the destructive potential of ransomware. Organizations need to adapt their security monitoring to detect anomalous use of forensic tools and implement strict access controls to prevent unauthorized deployment.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Oct 2025, 20:23 UTC

Technical details

References

Community reviews

Related threats