Attackers Turn Velociraptor Into Backdoor for Ransomware Deployment by Husain Parvez

Published on: September 4, 2025
Writer

Sophos researchers have uncovered a new twist in attacker tradecraft: the abuse of Velociraptor, a legitimate open-source incident response tool, to gain remote access and set up persistence on compromised systems. The discovery highlights how tools designed for defense can be flipped into offensive assets.

According to Sophos’ Counter Threat Unit (CTU), “In this incident, the threat actor used the tool to download and execute Visual Studio Code with the likely intention of creating a tunnel to an attacker-controlled command and control (C2) server.” The technique triggered a Taegis alert when Visual Studio Code’s tunneling option was enabled, a feature that has been misused by multiple threat groups in the past.

Investigators say the attack began with the Windows msiexec utility fetching an installer from a Cloudflare Workers domain that appeared to host staging files, including Velociraptor, Cloudflare Tunnel, and the Radmin remote administration tool.

Once Velociraptor was installed and configured to talk to a C2 domain, the attacker used PowerShell to download Visual Studio Code from the same location and run it as a background service. Further malware payloads were then retrieved using msiexec. Sophos concluded the activity “would likely have led to ransomware deployment” if not detected in time.

This marks an escalation from the more familiar abuse of remote monitoring and management tools. As Sophos explained, “Organizations should monitor for and investigate unauthorized use of Velociraptor and treat observations of this tradecraft as a precursor to ransomware.” The warning underscores the growing need for companies to track not just traditional malware but also unexpected uses of legitimate security software.

Sophos has mapped the infrastructure used in the campaign to Cloudflare Workers domains files[.]qaubctgg[.]workers[.]dev and velo[.]qaubctgg[.]workers[.]dev. Security teams are urged to block these indicators and implement strong endpoint detection and response systems.