Ransomwarehigh
Legit tools, illicit uses: Velociraptor, Nezha turned against victims
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-6264 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints | 5.5 | 1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | files.qaubctgg.workers.dev | an installer ( v2.msi ) from a Cloudflare Workers domain ( files[.]qaubctgg[.]workers[.]dev ). This location appears to be a staging folder for a |
| domain | velo.qaubctgg.workers.dev | ciraptor, which is configured to communicate with C2 server velo[.]qaubctgg[.]workers[.]dev . The attacker then used an encoded PowerShell comman |
From the original article
3 min read at helpnetsecurity.com
Threat actors are using an increasing variety of commercial and open-source products to carry out their attacks: according to researchers, Velociraptor and Nezha are the latest additions to their attack toolbox.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.