Hackers Turn Velociraptor DFIR Tool Into Weapon in LockBit Ransomware Attacks
Summary: Threat actors linked to Storm-2603, also known as CL-CRI-1040 or Gold Salem, abused the open-source DFIR tool Velociraptor in ransomware attacks, delivering an outdated version 0.73.4.0 vulnerable to CVE-2025-6264 to enable arbitrary command execution and endpoint takeover. In a mid-August 2025 attack, the actors gained initial access through the ToolShell SharePoint vulnerabilities, created domain admin accounts, moved laterally, modified Active Directory Group Policy Objects, disabled real-time protection, and deployed Warlock, LockBit, and Babuk ransomware.
Why it matters: Your incident response tooling is now an attack path: an outdated Velociraptor build with CVE-2025-6264 gave Storm-2603 command execution and endpoint takeover, and this is the first time the group has been tied to Babuk deployment. Halcyon attributes 48-hour development cycles and professional-grade practices to the crew, which it says shows the discipline and resources of nation-state-aligned actors rather than an opportunistic ransomware gang.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2025-6264
- Related
- Velociraptor leveraged in ransomware attacks Cyber Risks ·YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026