Skip to content

Velvet Ant

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.

ATT&CK ID: G1047
Techniques: 22
Tools: 2

Vulnerabilities it has exploited

CVE-2024-20399 Cisco NX-OSUnscored · exploited in the wild

Techniques

Initial Access

Valid Accounts External Remote Services

Execution

Windows Management Instrumentation Command and Scripting Interpreter System Services Hijack Execution Flow

Persistence

Boot or Logon Initialization Scripts Valid Accounts External Remote Services

Privilege Escalation

Boot or Logon Initialization Scripts Process Injection Valid Accounts

Stealth

Masquerading Process Injection Valid Accounts Exploitation for Stealth Hijack Execution Flow

Defense Impairment

Disable or Modify Tools Disable or Modify System Firewall

Credential Access

Network Sniffing

Discovery

Network Sniffing System Network Connections Discovery File and Directory Discovery

Lateral Movement

Remote Services Lateral Tool Transfer

Command and Control

Application Layer Protocol Proxy Data Encoding Non-Standard Port Encrypted Channel

Software

Impacket · PlugX

MITRE ATT&CK All threat actors