Velvet Ant

Techniques (MITRE ATT&CK)22

SourceMITRE ATT&CK

About the group

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity35

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 22

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Execution

Windows Management Instrumentation Unix Shell Service Execution

Persistence

RC Scripts External Remote Services

Credential access

Network Sniffing

Discovery

System Network Connections Discovery File and Directory Discovery

Lateral movement

SMB/Windows Admin Shares Lateral Tool Transfer

Command and control

Application Layer Protocol Internal Proxy Data Encoding Non-Standard Port Asymmetric Cryptography

defense-impairment

Disable or Modify Tools Disable or Modify System Firewall

stealth

Match Legitimate Resource Name or Location Process Injection Local Accounts Exploitation for Stealth DLL

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2024-20399MEDIUMEPSS 4%KEV MITRE ATT&CK

Velvet Ant uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →