Velvet Ant
- ID
- G1047
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.[1][2]
Techniques used (22)
- T1021.002 SMB/Windows Admin Shares
- T1036.005 Match Legitimate Resource Name or Location
- T1037.004 RC Scripts
- T1040 Network Sniffing
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1055 Process Injection
- T1059.004 Unix Shell
- T1071 Application Layer Protocol
- T1078.003 Local Accounts
- T1083 File and Directory Discovery
- T1090.001 Internal Proxy
- T1132 Data Encoding
- T1133 External Remote Services
- T1211 Exploitation for Stealth
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1571 Non-Standard Port
- T1573.002 Asymmetric Cryptography
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall