Velvet Ant

Reports per quarter

Techniques seen in the last two years

• T1018 1 report reports only
• T1021.004 1 report reports only
• T1027.013 1 report reports only
• T1036.003 1 report reports only
• T1036.005 1 report in ATT&CK
• T1046 1 report reports only
• T1049 1 report in ATT&CK
• T1057 1 report reports only
• T1059.001 1 report reports only
• T1059.008 1 report reports only

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

• T1021.002
• T1037.004
• T1040
• T1047
• T1055
• T1059.004
• T1071
• T1083
• T1132
• T1133
• T1211
• T1569.002

CVEs named in reports

• CVE-2024-20399 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   China-Nexus Threat Group ‘Velvet Ant’ Leverages a Zero-Day to Deploy Malware on Cisco Nexus Switches

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Leverages a Zero-Day to Deploy Malware on Cisco Nexus Switches

2. 6 April 2026

   China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response

3. 25 June 2024

   In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization

   file creation date fromORKL

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor In-Depth Analysis: Velvet Ant's Prolonged Cyber Attack on a Large Organization

4. 3 June 2024

   China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Newest first. Details opens the report in Explore.