1. Home
  2. Groups
  3. Velvet Ant

Velvet Ant

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.[1][2]

ID: G1047
Contributors: Oren Biderman, Sygnia; Amnon Kushnir, Sygnia
Version: 1.0
Created: 14 March 2025
Last Modified: 04 April 2025
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 Application Layer Protocol

Velvet Ant has used reverse SSH tunnels to communicate to victim devices.[1]
Enterprise T1037 .004 Boot or Logon Initialization Scripts: RC Scripts

Velvet Ant used a modified /etc/rc.local file on compromised F5 BIG-IP devices to maintain persistence.[1]
Enterprise T1059 .004 Command and Scripting Interpreter: Unix Shell

Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.[1]

Enterprise T1132 Data Encoding

Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.[1]
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.[1]
Enterprise T1211 Exploitation for Defense Evasion

Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.[2]
Enterprise T1133 External Remote Services

Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.[1]
Enterprise T1083 File and Directory Discovery

Velvet Ant has enumerated local files and folders on victim devices.[1]
Enterprise T1574 .001 Hijack Execution Flow: DLL

Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.[1]
Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.[1]
.004 Impair Defenses: Disable or Modify System Firewall

Velvet Ant modified system firewall settings during PlugX installation using netsh.exe to open a listening, random high number port on victim devices.[1]
Enterprise T1570 Lateral Tool Transfer

Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.[1]
Enterprise T1036 .005 Masquerading: Match Legitimate Resource Name or Location

Velvet Ant used a malicious DLL, iviewers.dll, that mimics the legitimate "OLE/COM Object Viewer" within Windows.[1]
Enterprise T1040 Network Sniffing

Velvet Ant has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.[1]
Enterprise T1571 Non-Standard Port

Velvet Ant has used random high number ports for PlugX listeners on victim devices.[1]
Enterprise T1055 Process Injection

Velvet Ant initial execution included launching multiple svchost processes and injecting code into them.[1]
Enterprise T1090 .001 Proxy: Internal Proxy

Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.[1]
Enterprise T1021 .002 Remote Services: SMB/Windows Admin Shares

Velvet Ant has transferred tools within victim environments using SMB.[1]
Enterprise T1049 System Network Connections Discovery

Velvet Ant has enumerated existing network connections on victim devices.[1]
Enterprise T1569 .002 System Services: Service Execution

Velvet Ant executed and installed PlugX as a Windows service.[1]
Enterprise T1078 .003 Valid Accounts: Local Accounts

Velvet Ant accessed vulnerable Cisco switch devices using accounts with administrator privileges.[2]
Enterprise T1047 Windows Management Instrumentation

Velvet Ant used the wmiexec.py tool within Impacket for remote process execution via WMI.[1]

Software

ID Name References Techniques
S0357 Impacket Velvet Ant used Impacket for lateral tool transfer and remote process execution.[1] Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Lateral Tool Transfer, Network Sniffing, OS Credential Dumping: NTDS, OS Credential Dumping: LSASS Memory, OS Credential Dumping: Security Account Manager, OS Credential Dumping: LSA Secrets, Steal or Forge Kerberos Tickets: Kerberoasting, Steal or Forge Kerberos Tickets: Ccache Files, System Services: Service Execution, Windows Management Instrumentation
S0013 PlugX Velvet Ant heavily relies on variants of PlugX for various phases of operations.[1] Application Layer Protocol: Web Protocols, Application Layer Protocol: DNS, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, File and Directory Discovery, Hide Artifacts: Hidden Files and Directories, Hijack Execution Flow: DLL, Impair Defenses: Disable or Modify System Firewall, Ingress Tool Transfer, Input Capture: Keylogging, Masquerading: Masquerade Task or Service, Masquerading: Match Legitimate Resource Name or Location, Modify Registry, Native API, Network Share Discovery, Non-Application Layer Protocol, Non-Standard Port, Obfuscated Files or Information, Process Discovery, Query Registry, Screen Capture, System Network Connections Discovery, Trusted Developer Utilities Proxy Execution: MSBuild, Virtualization/Sandbox Evasion: System Checks, Web Service: Dead Drop Resolver

References

  1. Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.
  1. Sygnia Team. (2024, July 1). China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response. Retrieved March 14, 2025.