- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2023–2026
- Status
- Active
- ATT&CK
- G1047 · 22 techniques
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0474 · velvet-ant
ChinaWhat it is
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Velvet Ant (Deprecated)
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- ThreatActor.info (Malpedia et al.)China · high
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- China Chopper
- Cyber Eye RAT
- CyberGate
- ESRDE
- EarthWorm
- Impacket
- PlugX
- SHIPSHAPE
- ShadowPad Winnti
- Unknown Logger
- VELVETSTING
- VELVETTAP
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th