Velvet Ant
[Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https://attack.mitre.org/groups/G1047) is associated with complex persistence mechanisms, the targeting of…
Tag: Velvet Ant
China-Linked Velvet Ant Backdoored Linux PAM and OpenSSH for Nearly a Decade
Sygnia, tracking the China-nexus group as Velvet Ant, discovered that the group backdoored Linux PAM and OpenSSH components to maintain persistent access…
CVE-2024-20399: Cisco NX-OS Flaw Exploited by Velvet Ant
CVE-2024-20399 is a vulnerability in Cisco NX-OS that requires admin access and was exploited by the China-linked group Velvet Ant to plant…
Velvet Ant: China-Linked Cyber Espionage Group
Velvet Ant, tracked by Sygnia, is a China-nexus threat actor known for targeting infrastructure components like F5 BIG-IP, Cisco NX-OS, and Linux…
Operation Highland: Velvet Ant’s Long-Term Linux Login Backdoor Campaign
Operation Highland is a campaign by the China-linked Velvet Ant group that backdoored Linux PAM and OpenSSH components to maintain persistent access…