Início / Grupos de ameaça / Velvet Ant
Velvet Ant G1047
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
1
CVEs associadas
30
Técnicas
2
Malwares e ferramentas
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.
Vulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
“Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.”
Técnicas por tática
Acesso inicial
T1078.003 Local AccountsT1133 External Remote Services Execução
T1047 Windows Management InstrumentationT1059.004 Unix ShellT1569.002 Service ExecutionT1574.001 DLL Persistência
T1037.004 RC ScriptsT1078.003 Local AccountsT1133 External Remote Services Escalada de privilégios
T1037.004 RC ScriptsT1055 Process InjectionT1078.003 Local Accounts Furtividade
T1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1078.003 Local AccountsT1211 Exploitation for StealthT1574.001 DLL Comprometimento de defesas
T1685 Disable or Modify ToolsT1686 Disable or Modify System Firewall Acesso a credenciais
T1040 Network Sniffing Descoberta
T1040 Network SniffingT1049 System Network Connections DiscoveryT1083 File and Directory Discovery Movimento lateral
T1021.002 SMB/Windows Admin SharesT1570 Lateral Tool Transfer Comando e controle
T1071 Application Layer ProtocolT1090.001 Internal ProxyT1132 Data EncodingT1571 Non-Standard PortT1573.002 Asymmetric Cryptography © The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.