7 matches found
Velociraptor leveraged in ransomware attacks
Cisco Talos has confirmed that ransomware operators are leveraging Velociraptor, an open-source digital forensics and incident response DFIR tool that had not previously been definitively tied to ransomware incidents. We assess with moderate confidence that this activity can be attributed to thre...
CVE-2025-6264
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...
CVE-2025-6264
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...
CVE-2025-6264
creationtimestamp| type| source ---|---|--- 2025-06-20 02:43:10+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18894 2025-06-20 03:44:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrz4qjqujj2k 2025-10-09 12:00:02+00:00| seen|...
CVE-2025-6264 Velociraptor priviledge escalation via UpdateConfig artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...
CVE-2025-6264 Velociraptor priviledge escalation via UpdateConfig artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...
CVE-2025-6264
Velociraptor CVE-2025-6264 describes privilege escalation via the Admin.Client.UpdateClientConfig artifact. The issue arises because this artifact does not enforce an additional required permission, allowing users with COLLECT_CLIENT (usually Investigator) to collect it and update configuration. ...