CyberSecurityBoardThreat Intel · CVEs · Products
Attack Groups

Velvet Ant: China-Linked Cyber Espionage Group

June 25, 2026

Velvet Ant, tracked by Sygnia, is a China-nexus threat actor known for targeting infrastructure components like F5 BIG-IP, Cisco NX-OS, and Linux login software (PAM, OpenSSH) to maintain long-term persistence. The group has been active since at least 2016, focusing on stealthy backdoors in trusted systems.