Velociraptor leveraged in ransomware attacks
Summary: In August 2025, Talos responded to a ransomware attack in which actors appearing to be affiliated with Warlock deployed Warlock, LockBit, and Babuk ransomware against VMware ESXi virtual machines and Windows servers, installing an outdated Velociraptor (version 0.73.4.0) vulnerable to privilege escalation CVE-2025-6264 to maintain stealthy persistent access. Talos assesses with moderate confidence the activity is attributable to Storm-2603, a suspected China-based actor first identified in July 2025 exploiting on-premises SharePoint ToolShell vulnerabilities, and observed the actors creating admin accounts synced to Entra ID, accessing the VMware vSphere console, and exfiltrating data via a PowerShell script.
Why it matters: The endpoint monitoring tool your security team deploys for visibility became the intruder's persistence mechanism, relaunching on hosts even after isolation, and the use of two ransomware variants in one attack is what raised Talos's confidence in the attribution.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-6264
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026