FORENSIA

THREAT_ACTOR · G1047

Velvet Ant

Also known as: Velvet Ant

Profile

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.

MITRE ATT&CK ↗

Techniques

22 ATT&CK techniques attributed to this actor.

T1021.002 SMB/Windows Admin SharesT1036.005 Match Legitimate Resource Name or LocationT1037.004 RC ScriptsT1040 Network SniffingT1047 Windows Management InstrumentationT1049 System Network Connections DiscoveryT1055 Process InjectionT1059.004 Unix ShellT1071 Application Layer ProtocolT1078.003 Local AccountsT1083 File and Directory DiscoveryT1090.001 Internal ProxyT1132 Data EncodingT1133 External Remote ServicesT1211 Exploitation for StealthT1569.002 Service ExecutionT1570 Lateral Tool TransferT1571 Non-Standard PortT1573.002 Asymmetric CryptographyT1574.001 DLLT1685 Disable or Modify ToolsT1686 Disable or Modify System Firewall

Software

2 malware/tools attributed to this actor.

PlugXImpacket

Related corpus activity

9,125 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Velvet Ant.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-2492cve—852
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2020-22658cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2025-23304cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2022-47945cve—851
cve-2021-4045cve—851
cve-2016-5681cve—852
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,125.