Velociraptor DFIR is an open-source Digital Forensics and Incident Response framework used for endpoint data collection and remote management.
Overview
Velociraptor DFIR is an open-source Digital Forensics and Incident Response framework used for endpoint data collection and remote management. Recently, threat actors weaponized Velociraptor to enable stealthy command-and-control (C2) channels and ransomware deployment, highlighting how legitimate tooling can be repurposed for malicious activity. This underscores the risk of abuse of DFIR tooling and the need for strong monitoring of Velociraptor deployments and usage.
Related Threat Clusters
-
Hackers Exploit Velociraptor DFIR Tool for C2 and Ransomware Attacks
Hackers are utilizing the Velociraptor DFIR tool to establish stealthy command and control (C2) operations and deploy ransomware. This method enhances their ability to evade detection while executing cyber attacks.…
2 articles · Updated December 4, 2025
Recent Intelligence Reports
- Hackers Weaponize Velociraptor DFIR for Stealthy C2 and Ransomware Deployment — Gbhackers · December 4, 2025