Skip to content

Velvet Ant

IntrusionSet · ATTACK:enterprise:G1047

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1047",
  "title": "Velvet Ant",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1047",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--e1fc262c-dad2-4b82-abda-5f08dd134971",
  "external_id": "G1047",
  "domain": "enterprise",
  "created": "2025-03-14T19:21:17.470Z",
  "modified": "2026-07-31T18:48:23.128Z",
  "version": "1.0",
  "aliases": [
    "Velvet Ant"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Sygnia VelvetAnt 2024B",
      "url": "https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/"
    },
    {
      "source_name": "Sygnia VelvetAnt 2024A",
      "url": "https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:S0013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006104e8-1188-4fcf-b0b0-c7a7131bcdad

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d383bcc-2aea-4044-a3ff-b42f7b47ecde

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1236d556-1b4a-4d0f-96b2-cf036b30ca17

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1132

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d5cfd77-4222-48d0-b9f0-90487caeb952

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--341a8145-4d62-4126-a18d-10976d08d920

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ba68905-3ef8-4af4-a4e5-c956be4e33c0

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47e672a4-8646-420a-9847-ba801b0ff52a

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48611952-483d-4469-a3f1-745b40207055

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48eca132-7473-451e-a4ec-b6658c0cb893

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d20e130-46a0-4dbe-ac36-ea620e187770

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d453252-ae9c-48c0-a9ab-2ca700855e3f

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d91bd80-37e8-401d-8ff6-79b968cebbad

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67cb9148-b324-424f-9e16-de3a91e23e4a

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c1da156-9a34-4aa4-a57a-b376edb8707e

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ce9578b-a538-4ac1-8739-dfbd835f7599

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1037.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b636fe8-0ea3-40de-92f9-76ba806352b9

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9901579-54a9-407a-ab28-6aa9befc978f

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc4ba2dc-e9f4-4047-959d-c18d0bafcf8a

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c812f373-23ba-4825-aa0b-6546cf6105e8

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1211

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c875bba4-cfc1-439d-919f-ed0997b9288b

Sygnia VelvetAnt 2024B

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d725ab2f-2dde-496b-b2a8-8ed250e14cce

Sygnia VelvetAnt 2024B

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9d62a84-34e0-4397-9e88-1a39d29e4e15

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db52ebfc-92b0-446d-9712-0b5c09e5e566

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1db30cc-c6c0-4ffd-8896-ff6beecae653

Sygnia VelvetAnt 2024A

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.