Hackers now use Velociraptor DFIR tool in ransomware attacks

Cisco Talos and other vendors observed a China-linked actor tracked as Storm-2603 abusing an outdated Velociraptor DFIR build (v0.73.4.0) subject to CVE-2025-6264 to establish persistent, privileged access and deploy LockBit and Babuk ransomware across Windows and VMware ESXi hosts; the campaign included account creation synced to Entra ID, remote execution (Impacket-style commands), disabling Defender via AD GPOs, scheduled tasks, a fileless PowerShell encryptor with per-run AES keys, and pre-encryption data exfiltration for double extortion, with IoCs published by researchers.