Velvet AntThreat actor
Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.From MITRE ATT&CK
Last reported 18 days ago, by The Hacker News1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“…restingly, the use of TinyShell has been previously attributed to China-nexus clusters like Liminal Panda, UNC3886 (aka Fire Ant), and Velvet Ant, all of which have singled out telecom networks and edge devices.”
Indicators in its reports
named in the reports above- mx.zxopfds[.]comin 1 report
Copy this indicator · defanged
Thanks — we review every report.