Velvet Ant — APT Profile

Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits; the group has been operating since at least 2021.

Tools & malware

Impacket Network Toolkit
PlugX Backdoor

Vendor research

China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response Sygnia
China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence Sygnia

Read the full analysis on IntelFusions