Velvet Ant
Description
(Sygnia) Velvet Ant is a sophisticated and innovative threat actor. The investigation confirmed the threat actor maintained a prolonged presence in the organization’s on–premises network for about three years. The overall goal behind this campaign was to maintain access to the target network for espionage. The threat actor achieved remarkable persistence by establishing and maintaining multiple footholds within the victim company’s environment. One of the mechanisms utilized for persistence was a legacy F5 BIG-IP appliance, which was exposed to the internet and which the threat actor leveraged as an internal Command and Control (C&C). After one foothold was discovered and remediated, the threat actor swiftly pivoted to another, demonstrating agility and adaptability in evading detection. The threat actor exploited various entry points across the victim’s network infrastructure, indicating a comprehensive understanding of the target’s environment.
Names
| Name | Name-Giver |
|---|---|
| Velvet Ant | Sygnia |
Country
Motivation
- Information theft and espionage
First Seen
2023
Observed Countries
Tools
Operations
- 2024-07: China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/ https://www.sygnia.co/blog/china-threat-group-velvet-ant-cisco-zero-day/
Information
Other Information
Uuid
7cf72da5-8428-4878-bf14-2f4e4e1ba7dc
Last Card Change
2024-08-27