Velvet Ant
Velvet Ant is a Chinese APT / state-backed threat actor. The provided content attributes attacks to the Chinese APT Velvet Ant and describes activity spanning F5 BIG-IP devices, Cisco switches, and Windows hosts. The actor exploited legacy F5 BIG-IP appliances for persistence and used a modified /etc/rc.local file to maintain access. On compromised F5 devices, Velvet Ant used the custom tools VELVETSTING to parse encoded inbound commands and execute them via the Unix shell, and VELVETTAP for packet capture. The group used reverse SSH tunnels / a reverse SSH shell as an encrypted channel to communicate with victim devices, and tunneled victim traffic through an internal compromised host to proxy communications to command-and-control nodes. The content also states Velvet Ant exploited CVE-2024-20399 on authenticated Cisco switches, allowing escape from the NX-OS CLI to the underlying operating system for arbitrary command execution, and references attacks targeting Cisco, Palo Alto, and Ivanti network edge devices via path OS command injection vulnerabilities. In Windows environments, Velvet Ant used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX, including a malicious DLL named iviewers.dll that mimicked the legitimate OLE/COM Object Viewer. PlugX was executed and installed as a Windows service. Initial execution included launching multiple svchost processes and injecting code into them. Additional behavior directly described in the content includes use of WMI and Impacket tooling, including wmiexec.py for remote process execution, lateral file transfer via SMB and Windows administrative shares, and file transfer within victim networks using the Impacket toolkit. Velvet Ant enumerated local files and directories and existing network connections on victim devices. For defense evasion, Velvet Ant attempted to disable local security tools and endpoint detection and response software, and modified system firewall settings during PlugX installation by using netsh.exe to open a listening random high-numbered port. Known alias in the provided content: velvet_ant.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
Associated vulnerabilities
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
3 more CVEs tied to this actor tracked in Mallory.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a threat actor associated with disabling or modifying tools.
Listed in the detection annotations as a threat actor associated with techniques involving Windows theme files, forced authentication, name resolution poisoning/SMB relay, and SMB/Windows admin shares.
Referenced as a threat actor associated with the defense-impairment technique of modifying Windows Filtering Platform policy to block EDR process communication.
Referenced as a threat actor associated with the technique of disabling or modifying security tools, specifically in the context of CrowdStrike agent registry key removal detection.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.