Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.12
- Sygnia VelvetAnt 2024A
- Sygnia VelvetAnt 2024B
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1090.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1211 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1021.002 | SMB/Windows Admin Shares | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037.004 | RC Scripts | — |
| T1040 | Network Sniffing | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1055 | Process Injection | — |
| T1059.004 | Unix Shell | — |
| T1071 | Application Layer Protocol | — |
| T1078.003 | Local Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1090.001 | Internal Proxy | — |
| T1132 | Data Encoding | — |
| T1133 | External Remote Services | — |
| T1211 | Exploitation for Stealth | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1571 | Non-Standard Port | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1574.001 | DLL | — |
| T1685 | Disable or Modify Tools | — |
| T1686 | Disable or Modify System Firewall | — |
Aliases
Velvet Ant
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.