Velociraptor

Reported Context (1)

In the previous campaigns, Warlock relied on Velociraptor as its primary C&C framework, paired with a single Cloudflare tunnel for remote access and Rclone disguised as TrendSecurity.exe for exfiltration. Warlock Ransomware Expands Its Attack Chain With Tunnels and Vulnerable-Driver Abuse

Malware (1)

People (5)

Threat Actors (2)

MITRE ATT&CK (15)

Vendors (4)

Products (4)

Tools (10)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.