Loading story…
Threat actors likely exploited the Windows Server Update Services (WSUS) remote code execution vulnerability CVE-2025-59287 to gain initial access, then installed the legitimate open-source forensic tool Velociraptor for command and control, Huntress reported. The attackers retrieved a malicious MSI package from s3[.]wasabisys[.]com and configured the client to communicate with update[.]githubtestbak[.]workers[.]dev. They subsequently ran Base64-encoded PowerShell commands and utilities to enumerate users, network configuration, and services. Huntress contained the incident and reported increased Velociraptor abuse during 2025, following its first observations in November 2024.
The incident illustrates a broader shift toward command-and-control channels that exploit trusted tools and permitted cloud traffic. Inde Technology highlighted Discord-based exfiltration, UAT-11587’s use of Microsoft Graph, SesameOp’s abuse of the OpenAI Assistants API, and ransomware operators’ use of legitimate administration tools. It also described experimental blockchain-based and Cloudflare Queues-based C2 implementations. These approaches complicate detection and takedowns, while blanket blocking can disrupt business services. Defensive priorities include patching and hardening WSUS and other privileged infrastructure, investigating unexpected administration-tool deployments, strengthening identity and endpoint controls, segmenting networks, and maintaining resilient backups rather than relying primarily on short-lived network indicators.
See which actors are running it and whether you're in range.
19 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos reported the UAT-11587 campaign and assessed the actor with high confidence as China-nexus. Its Rust backdoor used an attacker-registered Entra ID application to access Microsoft Graph, upload OneDrive heartbeats, and poll Outlook for commands; Cloudflare Pages and R2 staged its infection chain.
Microsoft reported an ACR Stealer ClickFix campaign that retrieved a payload or command-and-control address from a blockchain smart contract.
Huntress observed attackers deploy Velociraptor after gaining initial access through likely exploitation of WSUS vulnerability CVE-2025-59287. They retrieved an MSI from s3[.]wasabisys[.]com, installed an auto-start LocalSystem service, and configured it to communicate with update[.]githubtestbak[.]workers[.]dev.
Microsoft disclosed SesameOp following an incident-response investigation that found operators using hijacked Visual Studio utilities over several months. The malware used the OpenAI Assistants API as a command-and-control relay without invoking AI models.
Microsoft had made a patch available by October 23 for CVE-2025-59287, a deserialization vulnerability enabling remote code execution in Windows Server Update Services.
Cisco Talos publicly documented Velociraptor activity and attributed it with medium confidence to Storm-2603. Talos assessed that initial access in that case likely involved SharePoint ToolShell vulnerabilities.
According to Cisco Talos's subsequent reporting, UAT-11587 deployed a Rust backdoor against government and policy targets beginning in September 2025. The campaign ultimately affected approximately 350 endpoints across 16 environments in eight Asian countries.
Huntress SOC first observed threat actors misusing Velociraptor, a legitimate open-source digital forensics and incident response tool.
An intrusion investigated by IBM X-Force involved a Raspberry Pi Zero running P4wnP1 plugged into a self-checkout terminal. A JavaScript Discord bot encrypted and exfiltrated .dat files, while a gaming-traffic alert on the point-of-sale network indicated compromise.
An eight-country law enforcement operation took down Emotet, which had compromised more than one million hosts and operated several hundred servers across three botnets.
The article's author open-sourced a Mythic command-and-control profile that uses Cloudflare Queues as an asynchronous dead drop behind an authenticated public Worker endpoint. The profile supports the author's Thanatos agent fork and keeps Cloudflare account credentials out of the implant.
The article's author developed graphcat, an experimental framework that uses a public blockchain as an encrypted command-and-control message queue and HTTPS polling for agent communications. The author stated that there was no current intention to release it publicly.
Qilin operators used Splashtop's management service to execute Linux ransomware on Windows hosts through Windows Subsystem for Linux.
Trend Micro observed a Qilin affiliate using Atera to deploy AnyDesk, with ScreenConnect providing an additional remote-access channel.
Huntress SOC analysts contained the threat actor's activity in the WSUS incident.
Following installation in the WSUS incident, Velociraptor spawned multiple base64-encoded PowerShell commands using unrestricted execution policy. The attackers ran net.exe, quser.exe, setspn.exe, and ipconfig.exe to gather information about domain computers, users, services, and network configuration.
After successfully installing Velociraptor, the attackers made two additional attempts to run the same installation command from the same location.
Across September–November 2025, Huntress observed four Velociraptor-abuse cases, including the WSUS incident, two cases involving SharePoint ToolShell web shells, and one involving a Warlock ransom note. Operators used encoded PowerShell and Visual Studio Code and Cloudflare tunnels; three cases used workers.dev domains for Velociraptor command and control.
Emotet reemerged after the January 2021 eight-country takedown operation. The reference does not specify when its return occurred.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have begun leveraging Velociraptor, an open-source digital forensics and incident response (DFIR) tool, to facilitate and enhance their attacks on enterprise environments. Cisco Talos confirmed that Velociraptor, previously not definitively linked to ransomware campaigns, was used by threat actors believed to be associated with Storm-2603 and possibly a China-based group. These actors targeted VMware ESXi virtual machines and Windows servers, deploying multiple ransomware strains including Warlock, LockBit, and Babuk, which resulted in significant disruption to the victim's IT infrastructure. The attackers installed an outdated version of Velociraptor (0.73.4.0) that contained a privilege escalation vulnerability (CVE-2025-6264), enabling them to execute arbitrary commands and potentially take over endpoints. Velociraptor was used to maintain stealthy, persistent access, allowing the attackers to operate undetected while preparing and executing the ransomware payloads. In addition to Velociraptor, the attackers utilized the Windows msiexec utility to download and install tools from a Cloudflare Workers domain, including Visual Studio Code and the Radmin remote administration tool, further expanding their control and tunneling capabilities. Visual Studio Code was installed as a service and configured to create a tunnel to an attacker-controlled command-and-control (C2) server, with logs redirected for monitoring. The attackers also used encoded PowerShell commands to automate the download and execution of these tools. Sophos incident responders encountered the same threat actors in a separate incident, where they were able to prevent the final deployment of ransomware, but observed the same tactics, techniques, and procedures (TTPs). The use of Velociraptor in these attacks highlights a growing trend of threat actors repurposing legitimate security tools for malicious purposes, complicating detection and response efforts. The campaign demonstrates the attackers' ability to combine multiple open-source and commercial tools to achieve persistence, lateral movement, and data exfiltration. The presence of Babuk ransomware files on the victim's network marks a new development, as this strain had not previously been associated with Storm-2603. The attackers' use of multiple ransomware variants in a single campaign suggests a flexible and opportunistic approach to maximizing impact. The exploitation of a known vulnerability in Velociraptor underscores the importance of timely patching and monitoring of security tools themselves. The campaign also involved the use of Cloudflare tunneling and remote administration utilities, indicating a sophisticated approach to maintaining access and evading detection. The incident serves as a warning to organizations about the risks of outdated or misconfigured security tools being turned against them. Security teams are advised to monitor for unusual deployments of DFIR tools and to ensure all such software is kept up to date. The blending of legitimate and malicious activity in these attacks poses significant challenges for defenders, requiring enhanced vigilance and advanced detection capabilities.
Jun 29, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Active in-the-wild exploitation of **SolarWinds Web Help Desk (WHD)** vulnerabilities is being used to achieve **remote code execution (RCE)** on unpatched servers, followed by rapid deployment of legitimate remote administration tooling for persistence and interactive control. Huntress reported intrusions originating from the WHD service (via `wrapper.exe` spawning `java.exe` in the Tomcat-based application), where attackers executed `cmd.exe` to install a Zoho ManageEngine/Zoho Assist RMM agent for unattended access; at least one observed Zoho Assist registration was tied to a Proton Mail address (`esmahyft@proton[.]me`). The activity is linked to recently disclosed WHD issues, including **CVE-2025-40551** (untrusted deserialization leading to code execution, added to **CISA KEV**) and **CVE-2025-26399**, which multiple vendors have cited as being exploited in the wild. Post-compromise, the actor used the Zoho RMM process (`TOOLSIQ.EXE`) as an operational foothold to run **Active Directory discovery** and domain enumeration (e.g., `net group "domain computers" /do`) consistent with preparation for lateral movement. The intrusions also included deployment of **Velociraptor** for endpoint control and collection, and use of **Cloudflare tunnels** to maintain access and route traffic. Huntress noted broad exposure in its ecosystem (84 endpoints across 78 organizations running WHD), indicating a sizable attack surface for organizations that have not patched or mitigated affected WHD instances.
Jun 29, 2026