MITRE ATT&CKgroup
G1047 Velvet Ant
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-03-14
Description
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.
Related
Uses · MITRE ATT&CK (24)
- T1685 Disable or Modify Tools technique
- T1686 Disable or Modify System Firewall technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1090.001 Internal Proxy sub-technique
- T1571 Non-Standard Port technique
- T1078.003 Local Accounts sub-technique
- T1574.001 DLL sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.004 Unix Shell sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1037.004 RC Scripts sub-technique
- S0357 Impacket software (tool)
- T1211 Exploitation for Stealth technique
- S0013 PlugX software (malware)
- T1040 Network Sniffing technique
- T1047 Windows Management Instrumentation technique
- T1049 System Network Connections Discovery technique
- T1055 Process Injection technique
- T1071 Application Layer Protocol technique
- T1083 File and Directory Discovery technique
- T1132 Data Encoding technique
- T1133 External Remote Services technique
References
- https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/ Sygnia VelvetAnt 2024B
- https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/ Sygnia VelvetAnt 2024A