What tactics and techniques does Velvet Ant use?

How Velvet Ant Operates Inside Victim Environments

velvet ant’s activity is best understood as a long-dwell intrusion pattern rather than a single noisy exploit. The group relies on stealth, uses tools already present in the environment, and blends into normal administration so its actions look like routine work. Once established, that access supports follow-on discovery and collection without immediately triggering obvious alarms.

The practical implication is that defenders should think in terms of attacker behaviour over time, not just one initial compromise event. MITRE ATT&CK Enterprise Matrix is useful here because it organises the tactics behind stealth, credential access, discovery, lateral movement, and persistence into an investigation-friendly sequence.

A second useful lens is the access mechanism itself. In intrusions like this, the most damaging step is often not malware deployment but the abuse of legitimate access paths, remote sessions, and native tooling that security teams already expect to see. That makes behavioural context, host telemetry, and authentication patterns more important than file-based indicators alone.

What Tactics and Techniques Matter Most

Velvet Ant is associated with living-off-the-land activity, credential theft, internal discovery, and data collection after access is gained. Those techniques matter because they reduce the attacker’s footprint and make malicious activity resemble ordinary administrative work. Remote access used outside normal workflows, unusual use of system utilities, and staged internal reconnaissance are all consistent with that pattern.

These techniques are especially effective when an attacker can reuse valid accounts or session material. Top 10 Phishing Techniques is a relevant internal guide because credential theft and session abuse are often enabled by the same access-harvesting methods that attackers use to obtain trusted entry in the first place.

Once inside, the objective typically shifts from access to understanding. Internal discovery helps the actor identify valuable hosts, trusted pathways, and data stores, while collection activity turns that knowledge into exfiltration or later operational leverage. The defender’s challenge is that these steps can look like normal troubleshooting, inventory checking, or remote support unless they are correlated across time and account behaviour.

How Defenders Should Read the Signal

The strongest signal is often not a single malicious command, but a sequence that does not fit the user or host’s normal role. Look for native tooling invoked in unusual combinations, administrative sessions from unexpected sources, authentication events that do not match the help desk or ops model, and discovery commands running on systems that should not be performing broad reconnaissance. MITRE D3FEND complements that view by helping map detection and hardening measures to the specific offensive behaviours being used.

When investigators focus only on malware signatures, they miss the more durable part of the intrusion, which is the valid access path. That means the most useful detections usually combine process lineage, remote session telemetry, credential use, and unusual administrative timing rather than relying on one alert source alone.

Risk and Threat Considerations

Velvet Ant’s combination of stealth, living-off-the-land techniques, and credential theft creates a high risk of long-lived, low-visibility compromise. The main danger is that once valid access is established, the actor can blend into trusted activity, expand visibility inside the environment, and collect data before defenders recognise the intrusion.

Failure mechanism: The intrusion succeeds when stolen credentials, trusted remote access, or native tools let the actor operate inside the environment without standing out from normal administrative traffic. That suppresses obvious malware cues and delays detection until discovery or collection is already underway.

Impact: Organisations can lose visibility into which systems were touched, what data was accessed, and how far the actor moved. The longer the dwell time, the greater the chance of credential reuse, expanded access, and exfiltration from systems that appear legitimate on the surface.

Practitioner Guidance

What to verify: Confirm whether remote access, admin tooling, and account use align with normal change windows, support processes, and workstation roles. If the activity is valid in isolation but abnormal in sequence, treat it as suspicious even when each command or login looks benign on its own.

Decision rule: If an account used for remote administration or discovery cannot be explained by its normal job function, prioritise session review, credential validation, and host triage before assuming the activity is routine. If the same account appears across multiple systems in short succession, widen the scope quickly.

Practitioner takeaway: The core defence against Velvet Ant style activity is to detect abuse of trusted access, not just malicious code; if the actor can live off the land, your visibility must be strong enough to expose the pattern around the tools.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?