HACKERS TURN VELOCIRAPTOR DFIR TOOL INTO WEAPON IN LOCKBIT RANSOMWARE ATTACKS

Summary from the TLDR InfoSec newsletter

Threat actors associated with Storm-2603 are weaponizing Velociraptor, a legitimate open-source digital forensics and incident response tool, to facilitate LockBit and Warlock ransomware attacks. The abuse of trusted security utilities allows attackers to evade detection while conducting reconnaissance and lateral movement within compromised networks. Security teams should monitor for unauthorized Velociraptor deployments, implement application whitelisting, and review legitimate DFIR tool usage to distinguish between authorized security operations and malicious activity.