Hackers Unleash Velociraptor Tool for Ransomware Mayhem: China-Based Storm-2603 Strikes Again!
In a twist fit for a cyber-thriller, threat actors are now using the Velociraptor digital forensics tool to unleash LockBit and Babuk ransomware. This China-based adversary, known as Storm-2603, is turning open-source software into a weapon of mass encryption. Who knew velociraptors could be so sneaky?
Hot Take:
In an unexpected plot twist, cybercriminals have decided to take their inner paleontologist out for a spin by using Velociraptor, not to dig up fossils, but to bury data under layers of LockBit and Babuk ransomware. Maybe they thought that a digital Jurassic Park would make for a good disguise. Just remember, these predators don’t want to eat you, just your data—and maybe your wallet.
Key Points:
– Cybercriminals are using the Velociraptor DFIR tool to deploy LockBit and Babuk ransomware.
– The attackers are suspected to be a China-based group known as Storm-2603.
– They exploited a vulnerability in an outdated version of Velociraptor.
– The attack involved creating local admin accounts and accessing VMware vSphere for persistent control.
– Ransomware deployments were detected on both Windows and VMware ESXi systems.