Procedure examples

Velvet Ant has transferred tools within victim environments using SMB.

Velvet Ant used a malicious DLL, `iviewers.dll`, that mimics the legitimate "OLE/COM Object Viewer" within Windows.

Velvet Ant used a modified `/etc/rc.local` file on compromised F5 BIG-IP devices to maintain persistence.

Velvet Ant has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.

Velvet Ant used the `wmiexec.py` tool within Impacket for remote process execution via WMI.

Velvet Ant has enumerated existing network connections on victim devices.

Velvet Ant initial execution included launching multiple `svchost` processes and injecting code into them.

Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.

Velvet Ant has used reverse SSH tunnels to communicate to victim devices.

Velvet Ant accessed vulnerable Cisco switch devices using accounts with administrator privileges.

Velvet Ant has enumerated local files and folders on victim devices.

Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.

Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.

Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.

Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.

Velvet Ant executed and installed PlugX as a Windows service.

Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.

Velvet Ant has used random high number ports for PlugX listeners on victim devices.

Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.

Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.

Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.

Velvet Ant modified system firewall settings during PlugX installation using `netsh.exe` to open a listening, random high number port on victim devices.