← Back to Actors
Velvet Ant
Velvet Ant
[Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https://attack.mitre.org/groups/G1047) is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.(Citation: Sygnia VelvetAnt 2024A)(Citation: Sygnia VelvetAnt 2024B)
24
Techniques
24
Covered
0
Gaps
100%
Coverage
Coverage24/24
COVERED (24)
T1021.002SMB/Windows Admin Shares74 det.T1036.005Match Legitimate Resource Name or Location49 det.T1037.004RC Scripts11 det.T1040Network Sniffing15 det.T1047Windows Management Instrumentation88 det.T1049System Network Connections Discovery23 det.T1055Process Injection83 det.T1059.004Unix Shell177 det.T1071Application Layer Protocol120 det.T1078.003Local Accounts24 det.T1083File and Directory Discovery49 det.T1090.001Internal Proxy10 det.T1132Data Encoding1 det.T1133External Remote Services80 det.T1211Exploitation for Stealth6 det.T1562.001Disable or Modify Tools332 det.T1562.004Disable or Modify System Firewall50 det.T1569.002Service Execution65 det.T1570Lateral Tool Transfer23 det.T1571Non-Standard Port17 det.T1573.002Asymmetric Cryptography7 det.T1574.001DLL111 det.T1685Disable or Modify Tools281 det.T1686Disable or Modify System Firewall19 det.