Exploiting Velociraptor – Cyberattackers Use Incident Response Tool for Remote Access

Sophos CTU uncovered an attack campaign that abused legitimate DFIR and development tools—Velociraptor and Visual Studio Code tunneling—to create a covert C2 channel and persistent access. Attackers used msiexec to download staged installers (v2.msi, sc.msi) from Cloudflare Workers domains (files.qaubctgg.workers.dev, velo.qaubctgg.workers.dev), executed encoded PowerShell to enable tunneling, and prepared for likely ransomware deployment; detection via Taegis™ and rapid isolation prevented further spread. The report includes observed malware family names and IOCs and emphasizes treating unexpected Velociraptor or VS Code tunneling activity as high-risk.