Velvet Ant (G1047) | Threat Actor Index

About Velvet Ant

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.

View MITRE record ↗

Techniques by Tactic (22)

Initial Access

T1078.003 Local AccountsT1133 External Remote Services

Execution

T1047 Windows Management InstrumentationT1059.004 Unix ShellT1569.002 Service ExecutionT1574.001 DLL

Persistence

T1037.004 RC ScriptsT1078.003 Local AccountsT1133 External Remote Services

Privilege Escalation

T1037.004 RC ScriptsT1055 Process InjectionT1078.003 Local Accounts

Stealth

T1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1078.003 Local AccountsT1211 Exploitation for StealthT1574.001 DLL

Defence Impairment

T1685 Disable or Modify ToolsT1686 Disable or Modify System Firewall

Credential Access

T1040 Network Sniffing

Discovery

T1040 Network SniffingT1049 System Network Connections DiscoveryT1083 File and Directory Discovery

Lateral Movement

T1021.002 SMB/Windows Admin SharesT1570 Lateral Tool Transfer

Command & Control

T1071 Application Layer ProtocolT1090.001 Internal ProxyT1132 Data EncodingT1571 Non-Standard PortT1573.002 Asymmetric Cryptography

Toolsets (2)

🐛

PlugX S0013

Malware · Windows

🔧

Impacket S0357

Tool · Linux, macOS, Windows

References & Reports (2)