Home / Threat actors / Velvet Ant
Velvet Ant G1047
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
30
Techniques
2
Malware and tools
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.”
Techniques by tactic
Initial Access
T1078.003 Local AccountsT1133 External Remote Services Execution
T1047 Windows Management InstrumentationT1059.004 Unix ShellT1569.002 Service ExecutionT1574.001 DLL Persistence
T1037.004 RC ScriptsT1078.003 Local AccountsT1133 External Remote Services Privilege Escalation
T1037.004 RC ScriptsT1055 Process InjectionT1078.003 Local Accounts Stealth
T1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1078.003 Local AccountsT1211 Exploitation for StealthT1574.001 DLL Defense Impairment
T1685 Disable or Modify ToolsT1686 Disable or Modify System Firewall Credential Access
T1040 Network Sniffing Discovery
T1040 Network SniffingT1049 System Network Connections DiscoveryT1083 File and Directory Discovery Lateral Movement
T1021.002 SMB/Windows Admin SharesT1570 Lateral Tool Transfer Command and Control
T1071 Application Layer ProtocolT1090.001 Internal ProxyT1132 Data EncodingT1571 Non-Standard PortT1573.002 Asymmetric Cryptography © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.