Velociraptor Misuse, Pt. II: The Eye of the Storm

## Executive summary Huntress investigated three related incidents where attackers exploited SharePoint (ToolShell) and previously WSUS vulnerabilities to install Velociraptor as a C2/remote execution platform, use legitimate tools (VS Code, Cloudflare tunnels, OpenSSH) to evade detection, and in one case deploy Warlock ransomware; the report provides timelines, forensic artifacts, IOCs, and remediation notes.