Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Velvet Ant · Unknown · mitre-attack · refreshed 2026-10-06

Velvet Ant

MITRE G1047 ↗

Velvet Ant — ATT&CK roseVA

attack rose · 22 techniques across 8 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2024-20399

Analyst brief

mitre-attack

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

22 techniques · 8 of 15 tactics

  1. Execution

    3 techniques

  2. Persistence

    2 techniques

  3. Stealth

    5 techniques

  4. Defense impairment

    2 techniques

  5. Credential access

    1 technique

  6. Discovery

    2 techniques

  7. Lateral movement

    2 techniques

  8. Command and control

    5 techniques

select a technique

Arsenal

1 malware · 1 tools
Malware
Malware · 1ATT&CK
PlugXS0013 ↗
Tools
Tools · 1ATT&CK
ImpacketS0357 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Velvet Ant is cited as exploiting

none on KEV
  1. CVE-2024-203992026-10-17
    1. “Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.attack.mitre.org/groups/G1047
  2. 2.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group…
  3. 3.sygnia.co/blog/china-nexus-threat-group-velvet-ant

Track Velvet Ant on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.