CVE-2025-6264: 
Velociraptor vulnerability analysis and mitigation

CVE-2025-6264 is a privilege escalation vulnerability in Rapid7's Velociraptor open-source DFIR platform, caused by the Admin.Client.UpdateClientConfig artifact failing to enforce an additional required permission beyond COLLECT_CLIENT. This allows users with the "Investigator" role to collect the artifact and modify endpoint configurations, leading to arbitrary command execution and endpoint takeover. All versions prior to 0.74.3 are affected. The vulnerability was published on June 20, 2025, with a CVSS v3.1 base score of 4.7 (Medium) per the GitHub Advisory, though Feedly's network-based scoring assigns 5.5 (Medium) (GitHub Advisory, Velociraptor Advisory).

The root cause is CWE-276 (Incorrect Default Permissions): the Admin.Client.UpdateClientConfig artifact, which is designed to update client-side configuration, did not require the elevated EXECVE permission that other dangerous artifacts mandate — only the standard COLLECT_CLIENT permission was checked (GitHub Advisory). An attacker who already holds the "Investigator" role within Velociraptor can exploit this by collecting the artifact against managed endpoints and supplying a malicious configuration, which executes with the elevated privileges of the Velociraptor client agent. The fix was committed in the Velocidex/velociraptor repository (commit 21e7fd7) and released in version 0.74.3. In observed real-world attacks, threat actors installed a deliberately outdated version (0.73.4.0) of Velociraptor to retain access to this vulnerability (Talos Blog).

Successful exploitation allows an authenticated but lower-privileged user (Investigator role) to escalate privileges, modify endpoint configurations, and execute arbitrary commands on managed endpoints — effectively achieving full endpoint takeover. Because Velociraptor agents typically run with elevated system-level permissions and are deployed broadly across enterprise environments, a single compromised Investigator account can be leveraged to compromise all enrolled endpoints, enabling lateral movement, data exfiltration, and ransomware deployment. In confirmed incidents, threat actors used Velociraptor to maintain stealthy persistent access while deploying LockBit, Babuk, and Warlock ransomware across Windows servers and VMware ESXi VMs (Talos Blog, GitHub Advisory).

1. Initial Access: Obtain credentials for a Velociraptor user account with the "Investigator" role (which grants COLLECT_CLIENT permissions) — via phishing, credential stuffing, or lateral movement from a previously compromised host.
2. Reconnaissance: Identify the Velociraptor server version (target versions < 0.74.3) and enumerate enrolled endpoints via the Velociraptor GUI or API.
3. Artifact Collection: Log into the Velociraptor web console and navigate to the artifact collection interface. Select the Admin.Client.UpdateClientConfig artifact, which normally requires elevated permissions but does not enforce them in vulnerable versions.
4. Malicious Configuration Injection: Supply a crafted client configuration payload that includes a malicious command or points the Velociraptor client to an attacker-controlled C2 server (e.g., velo.qaubctgg.workers[.]dev as observed in the wild).
5. Persistence and Lateral Movement: The Velociraptor client agent executes the injected configuration with elevated privileges. Attackers can use this to install additional tools (e.g., Visual Studio Code tunnels for C2), create admin accounts, modify Group Policy Objects, and disable endpoint defenses.
6. Ransomware Deployment: With persistent elevated access across enrolled endpoints, deploy ransomware payloads (LockBit on Windows, Babuk on ESXi) and exfiltrate data via PowerShell scripts to attacker-controlled infrastructure (Talos Blog, GitHub Advisory).

• Network:

  • Outbound connections to velo.qaubctgg.workers[.]dev (Velociraptor C2 server used by Storm-2603)
  • Outbound connections to 65.38.121[.]226 (data exfiltration endpoint)
  • MSI download from stoaccinfoniqaveeambkp.blob.core.windows[.]net/veeam/v2.msi
  • HTTP PUT requests to http://65.38.121[.]226/test/<filename> (exfiltration)

• File System:

  • Velociraptor installer hash: 649BDAA38E60EDE6D140BD54CA5412F1091186A803D3905465219053393F6421
  • velociraptor.exe hash: 12F177290A299BAE8A363F47775FB99F305BBDD56BBDFDDB39595B43112F9FB7
  • Malicious Velociraptor config.yaml hash: A29125333AD72138D299CC9EF09718DDB417C3485F6B8FE05BA88A08BB0E5023
  • Files encrypted with .xlockxlock extension (Warlock/LockBit) or .babyk extension (Babuk on ESXi)
  • In.exe (Internal Monologue NTLM downgrade tool): C74897B1E986E2876873ABB3B5069BF1B103667F7F0E6B4581FBDA3FD647A74A
  • Temporary batch files in %SYSTEMROOT% (e.g., TkTvjYUp.bat)

• Process:

  • msiexec /q /i spawning Velociraptor installation from remote URL
  • Velociraptor process persisting after host isolation
  • cmd.exe executing Smbexec-style commands via %COMSPEC% /Q /c echo
  • PowerShell scripts with $ProgressPreference = 'SilentlyContinue' and Start-Sleep for evasion

• Logs:

  • Velociraptor audit logs showing Admin.Client.UpdateClientConfig artifact collected by Investigator-role accounts
  • Windows Event Logs showing new admin account creation syncing to Entra ID
  • Group Policy modification events (Event ID 5136) disabling Defender real-time protection and behavior monitoring
  • Scheduled task creation events by actor-controlled accounts (Talos Blog)

Upgrade Velociraptor to version 0.74.3 or later, which enforces the required elevated permission on the Admin.Client.UpdateClientConfig artifact (GitHub Advisory, Velociraptor Advisory). As interim mitigations, restrict COLLECT_CLIENT permissions to only trusted users, audit and reduce the number of accounts with the "Investigator" role, and monitor Velociraptor audit logs for unexpected collection of the Admin.Client.UpdateClientConfig artifact. Implement network-level controls to restrict Velociraptor server access to authorized management hosts only, and ensure Velociraptor agents are not running on internet-exposed systems without additional authentication controls. CISA has mandated remediation for federal agencies by the KEV catalog deadline (CISA KEV).

Cisco Talos published a detailed threat spotlight on October 9, 2025, attributing exploitation to Storm-2603 and documenting the full ransomware campaign TTPs, which generated significant coverage across the security community (Talos Blog). Sophos independently reported Velociraptor abuse for remote access in August 2025, predating the Talos disclosure (Sophos). The story was widely covered by BleepingComputer, The Hacker News, The Register, CSO Online, and SecurityAffairs, with community discussion on Mastodon and Bluesky highlighting the irony of a DFIR tool being weaponized against defenders. CISA's addition of CVE-2025-6264 to the KEV catalog on October 14, 2025, amplified urgency, with multiple security researchers on social media emphasizing the risk to organizations running unpatched Velociraptor deployments.