Velvet Ant

Summary

Espionage actor named by Sygnia (MITRE G1047), operating since at least 2021. Sygnia found it inside a large organisation for about three years, until late 2023, persisting through repeated eradication attempts. It moved from modern endpoints to legacy Windows Server 2003 hosts and to two internet-facing legacy F5 BIG-IP appliances, which it used as internal command-and-control. On the F5 devices it ran custom tools Sygnia names VELVETSTING (hourly command polling), VELVETTAP (packet capture) and ESRDE, made persistent through rc.local (T1037.004, T1040). On Windows it relied on PlugX loaded by DLL search-order hijacking (T1574.001) and installed as a service (T1569.002), routed some PlugX traffic through an internal file server (T1090.001), and tampered with EDR products (T1685). In July 2024 Sygnia disclosed that the group had exploited Cisco NX-OS CVE-2024-20399 as a zero-day: with valid switch-administrator credentials it escaped the NX-OS CLI to run code on Cisco Nexus switches (T1211, T1078.003). Cisco learned of exploitation attempts in April 2024. Sygnia assesses the actor as China-nexus and state-sponsored, citing target selection, network-device focus, a toolset that includes PlugX and ShadowPad, and DLL side-loading. It also says shared tooling among China-nexus intrusion sets prevents attribution to a known group and that a false flag cannot be ruled out, so the country is held at low confidence. Sygnia has not disclosed the victim.

Attribution

Not tied to a known group; false flag not ruled out (Sygnia)

Hedged, circumstantial or press-only reporting; not established.

• Sygnia (Research, 2024-06-03)
  Evidence suggests a China-nexus state-sponsored actor

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 10

Malware and tools 5

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• Internet-exposed legacy F5 BIG-IP appliances with a reverse SSH tunnel to its C&C (Sygnia, 2024)
• PlugX re-pointed at an internal file server as C&C (port 13742) on legacy hosts (Sygnia, 2024)

Reporting and advisories 3

• Sygnia
  China-Nexus Threat Group 'Velvet Ant' Abuses F5 Load Balancers for Persistence (Jun 2024)
• Sygnia
  China-Nexus Threat Group 'Velvet Ant' Exploits Cisco Zero-Day (CVE-2024-20399) (Jul 2024)
• Cisco
  Cisco NX-OS Software CLI Command Injection Vulnerability (cisco-sa-nxos-cmd-injection-xD9OhyOP)