G1047 · ATT&CK 20.0 group
Velvet Ant
Aliases: Velvet Ant
[Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https://attack.mitre.org/groups/G1047) is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.(Citation: Sygnia VelvetAnt 2024A)(Citation: Sygnia VelvetAnt 2024B)
Aliases: Velvet Ant
ATT&CK techniques
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037.004 RC Scripts simulation — Exact active technique ID
- T1037.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1040 Network Sniffing simulation — Exact active technique ID
- T1040 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055 Process Injection simulation — Exact active technique ID
- T1055 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071 Application Layer Protocol simulation — Exact active technique ID
- T1071 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.001 Internal Proxy simulation — Exact active technique ID
- T1090.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132 Data Encoding simulation — Exact active technique ID
- T1132 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1211 Exploitation for Stealth simulation — Exact active technique ID
- T1211 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1569.002 Service Execution simulation — Exact active technique ID
- T1569.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.002 Asymmetric Cryptography simulation — Exact active technique ID
- T1573.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686 Disable or Modify System Firewall simulation — Exact active technique ID
- T1686 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Prompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-matchModule 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-matchModule 9 — AI-assisted offensive security and MCP
Red Team & Offensive Security · topic-matchModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · topic-matchMemory-safety and low-level weakness classes
Vulnerability Research & Exploit Development · topic-matchStatic triage: strings, imports, resources, and capabilities
Malware Analysis & Reverse Engineering · topic-matchMemory forensics, injection, and resident behavior
Malware Analysis & Reverse Engineering · topic-matchModule 3 — Vulnerability discovery and validation
Red Team & Offensive Security · topic-matchMobile and Android vulnerability research
Vulnerability Research & Exploit Development · topic-matchHuman, workload, pipeline, and emergency identity
Cloud Security · topic-matchEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · topic-match
AI Security · topic-matchModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-matchModule 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-matchModule 9 — AI-assisted offensive security and MCP
Red Team & Offensive Security · topic-matchModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · topic-matchMemory-safety and low-level weakness classes
Vulnerability Research & Exploit Development · topic-matchStatic triage: strings, imports, resources, and capabilities
Malware Analysis & Reverse Engineering · topic-matchMemory forensics, injection, and resident behavior
Malware Analysis & Reverse Engineering · topic-matchModule 3 — Vulnerability discovery and validation
Red Team & Offensive Security · topic-matchMobile and Android vulnerability research
Vulnerability Research & Exploit Development · topic-matchHuman, workload, pipeline, and emergency identity
Cloud Security · topic-matchEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · topic-match