G1047: Velvet Ant
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.[1][2]
Security context for executives and security teams
G1047: Velvet Ant describes [Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https://attack.mitre.org/groups/G1047) is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.(Citation: Sygnia VelvetAnt 2024A)(Citation: Sygnia VelvetAnt 2024B)
Executive priority
G1047: Velvet Ant is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G1047: Velvet Ant by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G1047: Velvet Ant appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Velvet Ant
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1090.001 | Internal ProxySub-technique | Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.[1] |
| Enterprise | T1574.001 | DLLSub-technique | Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.[1] |
| Enterprise | T1132 | Data Encoding | Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.[1] |
| Enterprise | T1047 | Windows Management Instrumentation | Velvet Ant used the `wmiexec.py` tool within Impacket for remote process execution via WMI.[1] |
| Enterprise | T1059.004 | Unix ShellSub-technique | Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.[1] |
| Enterprise | T1571 | Non-Standard Port | Velvet Ant has used random high number ports for PlugX listeners on victim devices.[1] |
| Enterprise | T1133 | External Remote Services | Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.[1] |
| Enterprise | T1570 | Lateral Tool Transfer | Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.[1] |
| Enterprise | T1040 | Network Sniffing | Velvet Ant has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.[1] |
| Enterprise | T1083 | File and Directory Discovery | Velvet Ant has enumerated local files and folders on victim devices.[1] |
| Enterprise | T1686 | Disable or Modify System Firewall | Velvet Ant modified system firewall settings during PlugX installation using `netsh.exe` to open a listening, random high number port on victim devices.[1] |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.[1] |
| Enterprise | T1569.002 | Service ExecutionSub-technique | Velvet Ant executed and installed PlugX as a Windows service.[1] |
| Enterprise | T1049 | System Network Connections Discovery | Velvet Ant has enumerated existing network connections on victim devices.[1] |
| Enterprise | T1037.004 | RC ScriptsSub-technique | Velvet Ant used a modified `/etc/rc.local` file on compromised F5 BIG-IP devices to maintain persistence.[1] |
| Enterprise | T1685 | Disable or Modify Tools | Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.[1] |
| Enterprise | T1055 | Process Injection | Velvet Ant initial execution included launching multiple `svchost` processes and injecting code into them.[1] |
| Enterprise | T1071 | Application Layer Protocol | Velvet Ant has used reverse SSH tunnels to communicate to victim devices.[1] |
| Enterprise | T1211 | Exploitation for Stealth | Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.[2] |
| Enterprise | T1078.003 | Local AccountsSub-technique | Velvet Ant accessed vulnerable Cisco switch devices using accounts with administrator privileges.[2] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | Velvet Ant used a malicious DLL, `iviewers.dll`, that mimics the legitimate "OLE/COM Object Viewer" within Windows.[1] |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | Velvet Ant has transferred tools within victim environments using SMB.[1] |
Groups, software, and campaigns
S0013: PlugX
S0357: Impacket
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | 37e7e62cefaa… | ||
| 19.1 | 1.0 | Older bundle | 4e548399b719… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Sygnia VelvetAnt 2024A
Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.
Open source URL - [2]Sygnia VelvetAnt 2024B
Sygnia Team. (2024, July 1). China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response. Retrieved March 14, 2025.
Open source URL - [3]mitre-attackG1047Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.