Velociraptor incident response tool abused for remote access – Sophos News

In August 2025, Counter Threat Unit™ (CTU) researchers investigated an intrusion that involved deployment of the legitimate open-source Velociraptor digital forensics and incident response (DFIR) tool. In this incident, the threat actor used the tool to download and execute Visual Studio Code with the likely intention of creating a tunnel to an attacker-controlled command and control (C2) server. Enabling the tunnel option in Visual Studio Code triggered a Taegis™ alert, as this option can allow both remote access and remote code execution and has been abused by multiple threat groups in the past.

The threat actor used the Windows msiexec utility to download an installer (v2.msi) from a Cloudflare Workers domain (files[.]qaubctgg[.]workers[.]dev). This location appears to be a staging folder for attacker tools, including the Cloudflare tunneling tool and the Radmin remote administration tool. This file installed Velociraptor, which is configured to communicate with C2 server velo[.]qaubctgg[.]workers[.]dev. The attacker then used an encoded PowerShell command to download Visual Studio Code (code.exe) from the same staging folder and executed it with the tunnel option enabled. The threat actor installed code.exe as a service and redirected the output to a log file. They then used the msiexec Windows utility again to download additional malware (sc.msi) from the workers[.]dev folder (see Figure 1).

Figure 1: Process tree showing Velociraptor creating Visual Studio Code tunnel.

The Visual Studio Code tunneling activity triggered a Taegis alert that prompted a Sophos investigation. The analysts provided mitigation advice that enabled the customer to quickly implement remediations such as isolating the affected host, which prevented the attacker from achieving their objectives. Analysis suggests that the malicious activity would likely have led to ransomware deployment.

Threat actors often abuse remote monitoring and management (RMM) tools. In some instances, they leverage preexisting tools on the targeted systems. In others, they deploy the tools during the attack. The Velociraptor incident reveals attackers pivoting to using incident response tools to gain a foothold in a network and minimize the amount of malware they deploy.

Organizations should monitor for and investigate unauthorized use of Velociraptor and treat observations of this tradecraft as a precursor to ransomware. Implementing an endpoint detection and response system, monitoring for unexpected tools and suspicious behaviors, and following best practices for securing systems and generating backups can mitigate the ransomware threat. The impact of an attack is greatly reduced if it is caught prior to ransomware deployment.

The following Sophos protections detect activity related to this threat:

• Troj/Agent-BLMR
• Troj/BatDl-PL
• Troj/Mdrop-KDK

To mitigate exposure to this malware, CTU™ researchers recommend that organizations use available controls to review and restrict access using the indicators listed in Table 1. The domains may contain malicious content, so consider the risks before opening them in a browser.

Table 1: Indicators for this threat.