CVE

CVE-2025-6264

View on NVD ↗

Velociraptor priviledge escalation via UpdateConfig artifact

Exploitation IoCs 24

Domain auth[.]qgtxtebl[.]workers[.]dev
Domain files[.]catbox[.]moe
Domain vdfccjpnedujhrzscjtq[.]supabase[.]co
Filename 7z.exe
Filename C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z
Filename C:\ProgramFiles\Velociraptor\Velociraptor.exe
Filename C:\programdata\rsndispot.sys
MD5 054a32d6033b1744dca7f49b2e466ea2
MD5 0fd91321bf7ff7245dda9b7b5d791ace8
MD5 112a86eca3cb5a0b5e20ab744cc5af93
MD5 2c32e44a013cbfc5a323efb7694701d2
MD5 2d9ebf9c042f596f435865b40edad928
MD5 3a55d8f8f29716c694671834d8c6cb29
MD5 3d553b9061c03f891ce97d7d2e64ddee
MD5 991ec6e04413f2d4d29341c17a8a54d5
MD5 a930f81e3fb0a226ec5904d9043a17b8
IP 199[.]232[.]210[.]172
IP 204[.]76[.]203[.]219
IP 45[.]91[.]94[.]204
IP 49[.]51[.]132[.]100
IP 91[.]224[.]92[.]121
Package https://files.catbox.moe/8f7vex.msi
Package https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi
Package https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi

MITRE ATT&CK TTPs 15

T1018
Remote System Discovery
Discovery
 T1046
Network Service Discovery
Discovery
 T1055
Process Injection
Defense Evasion
 T1059.003
Windows Command Shell
Execution
 T1069
Permission Groups Discovery
Discovery
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1087
Account Discovery
Discovery
 T1090
Proxy
Command And Control
 T1133
External Remote Services
Persistence
 T1485
Data Destruction
Impact
 T1543.003
Windows Service
Persistence
 T1553
Subvert Trust Controls
Defense Evasion

Source Articles

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
In December 2025, threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution, deploying a fileless webshell within the IIS worker process (w3wp.exe). The attack used in-memory execution via a VirtualPathProvider-based implant to maintain persistence without writing to disk, enabling command and control, lateral movement, and data exfiltration. The actor deployed Velociraptor for post-compromise operations, attempted to deploy Warlock ransomware, and used EDR-killing techniques, but was partially blocked by security controls.
securelist Nov 5, 2026