Huntress Details Three Intrusions Abusing Velociraptor for Command-and-Control
Summary
Huntress investigated three intrusions involving Velociraptor for command-and-control, including SharePoint ToolShell exploitation, web shells, and tunnels using Cloudflare and VS Code. One incident involved Warlock ransomware; its initial access vector was undetermined
Key points
- In two incidents, investigators linked SharePoint compromise to ToolShell activity and web shells used to install Velociraptor as a service.
- Velociraptor was used for remote command execution; attackers also deployed Cloudflare tunnels and Visual Studio Code tunnels for remote access.
- Huntress found a shared MSI download source and a reused Cloudflare tunnel account tag across separate incidents.
- One investigation involved Warlock ransomware and Velociraptor on multiple endpoints; Huntress had limited visibility because its agent was installed mid-compromise.
- The Warlock incident's initial access could not be definitively established; a decryptor was later detected and quarantined by Windows Defender.
- Huntress recommends verifying authorized Velociraptor deployments and maintaining a baseline of approved software.
Article Details
- Attack Vectors
- ToolShell exploitation of SharePoint vulnerabilities to bypass authentication and achieve remote code execution, followed by web-shell activity.
- Exploitation of a WSUS vulnerability is discussed as an initial-access vector in a related incident; the article notes that the WSUS reference in Incident 3 may instead be vestigial.
- Malicious MSI files installed OpenSSH and Velociraptor; Velociraptor was then used for remote command execution and C2.
- Encoded PowerShell commands downloaded Visual Studio Code and configured tunnels; Cloudflare tunnels and TightVNC were also used to facilitate remote access.
- Defensive Notes
- Patch SharePoint and WSUS vulnerabilities and investigate unusual POST requests to SharePoint files such as start.aspx.
- Review and validate authorized Velociraptor instances and software installations; monitor for unexpected services, MSI execution, encoded PowerShell, and tunneling activity.
- Investigate Cloudflare and Visual Studio Code tunnel use when unauthorized, and review Windows Event Logs, IIS logs, and service-installation records for related activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chat[.]hcqhajfv[.]workers[.]dev | Domain configured as a secondary C2 channel in Incident 2. |
| DOMAIN | royal-boat-bf05[.]qgtxtebl[.]workers[.]dev | Download source for malicious MSI files used to install OpenSSH and Velociraptor in Incidents 1 and 2. |
| DOMAIN | update[.]githubtestbak[.]workers[.]dev | Velociraptor C2 domain used in Incident 3 and previously observed in the related Part One incident. |
| IPV4 | 38[.]54[.]16[.]179 | Source address shown making ToolShell-related SharePoint requests in Incident 1. |
| IPV4 | 91[.]236[.]230[.]76 | Source address of suspicious requests to start.aspx on the SharePoint server in Incident 2. |
| SHA256 | 040d7ee5b7bb0b978220be326804fa827f6284c8478a27af88c616fcacfeb423 | Hash associated with SecurityCheck.exe, which the article reports was flagged as malicious by VirusTotal vendors. |
| SHA256 | c70fafe5f9a3e5a9ee7de584dd024cb552443659f06348398d3873aa88fd6682 | Hash identified for the SecurityCheck MSI file associated with Incident 1. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe attacker ran netstat to check for a connection on port 35891.T1021.001 · Remote Desktop ProtocolThe attacker logged into an endpoint using RDP.T1021.004 · SSHThe attacker attempted to use OpenSSH remote port forwarding with an ssh command.T1059.001 · PowerShellEncoded PowerShell commands were executed through Velociraptor for tunneling and other actions.T1087.002 · Domain AccountThe attacker ran a command querying the domain admins group.T1136.001 · Local AccountThe attacker created the local user adminbak using the net user command.T1190 · Exploit Public-Facing ApplicationToolShell was used to exploit SharePoint vulnerabilities for initial access.T1219 · Remote Access ToolsAttackers used Velociraptor, Visual Studio Code tunnels, Cloudflare tunnels, and TightVNC to maintain remote access.T1505.003 · Web ShellThe attackers planted or modified ASPX web shells in SharePoint directories to run commands.T1543.003 · Windows ServiceVelociraptor and Security State Check were installed as Windows services.
CVE
CVE-2025-49704The ToolShell chain details how once authentication is bypassed, attackers chain a second vulnerability for remote code execution (CVE-2025-49704), as seen in this blog post by Viettel Cyber Security.CVE-2025-49706The exploit works by first bypassing authentication (CVE-2025-49706) through a specially-crafted HTTP request to /_layouts/15/ToolPane.aspx, which contains a Referer header set to /_layouts/SignOut.aspx (which can beCVE-2025-53770At that time, we observed active ToolShell attempts exploiting CVE-2025-53770 and CVE-2025-53771.CVE-2025-53771At that time, we observed active ToolShell attempts exploiting CVE-2025-53770 and CVE-2025-53771.CVE-2025-59287However, this statement regarding exploited vulnerabilities does harken back to part one of this series, where the threat actor targeted a WSUS vulnerability (CVE-2025-59287) to gain initial access.
People
Anna PhamAcknowledged for contributing to the investigation and writeup.Anton OvrutskyAcknowledged for contributing to the investigation and writeup.Ben FollandAcknowledged for contributing to the investigation and writeup.Harlan CarveyNamed author of the article.James NortheyNamed author of the article.Lindsey O'Donnell-WelchNamed author of the article.Michael TiggesAcknowledged for contributing to the investigation and writeup.
Threat Actors
Malware
Vendors
Products
CloudflareFor instance, we saw the same Cloudflare tunnel token account tag, and the same download source for installed MSI files, being used across different incidents.Microsoft Defender for EndpointThis customer had installed Microsoft Defender for Endpoint (MDE) and had apparently enabled network protection, evidenced by Microsoft-Windows-Windows Defender/1125 records in the Windows Defender Event Log.Microsoft SharePointw3wp.exe -ap "SharePoint - [REDACTED]443" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iis… -h "C:\inetpub\temp\apppools\SharePoint - [REDACTED]443\SharePoint - [REDACTED]443.config" -w "" -m 0OpenSSHFollowing the initial detections, a deeper investigation ensued, and illustrated that the threat actor had installed OpenSSH, then Velociraptor.SophosThe attacker also attempted to install a tool named SecurityCheck, via an MSI file, which was detected by both Windows Defender and Sophos, and quarantined by Windows Defender.TightVNCIn another attempt to facilitate access, they also installed open-source remote desktop software TightVNC, as seen via the binary path from EDR telemetry: "C:\Program Files\TightVNC\tvnserver.exe" -service.VelociraptorVelociraptor Misuse, Pt. II: The Eye of the StormVSCodeto ToolShell vulnerabilities for initial access and using encoded PowerShell commands to download Visual Studio Code (code.exe).Windows DefenderThis customer had installed Microsoft Defender for Endpoint (MDE) and had apparently enabled network protection, evidenced by Microsoft-Windows-Windows Defender/1125 records in the Windows Defender Event Log.Windows Server Update ServicesWe recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor.
Tools
ADExplorer64.exethe threat actor was seen authenticating to a user account separate from adminbak2 and running ADExplorer64.exe from that account, as well as domain enumeration commands (C:\Windows\system32\net1 group "domainSecurityCheckThe attacker also attempted to install a tool named SecurityCheck, via an MSI file, which was detected by both Windows Defender and Sophos, and quarantined by Windows Defender.