Velociraptor leveraged in ransomware attacks

Description

A ransomware attack involving the use of Velociraptor, an open-source digital forensics tool, has been linked to the threat actor Storm-2603. The attackers deployed Warlock, LockBit, and Babuk ransomware to encrypt virtual machines and servers. They exploited a vulnerability in an outdated version of Velociraptor for privilege escalation and persistence. The campaign involved disabling security measures, modifying Group Policy Objects, and using PowerShell scripts for encryption and data exfiltration. The attack bears similarities to Storm-2603's tactics, including the use of multiple ransomware variants and specific techniques like manipulating IIS components and GPOs. The incident highlights the growing trend of threat actors utilizing commercial and open-source tools in their operations.