Velvet Ant

Overview

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1211

TTPs — 22 techniques across 8 tactics

Tools & malware (2)

PlugX · Impacket

Reporting (2)

• China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response — Sygnia Team
• China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence — Sygnia Team