Velvet Ant Threat Actor Profile: Appliance Persistence, ATT&CK Mapping and Defences

Velvet Ant stays inside networks by living where defenders rarely look: forgotten load balancers, legacy servers without EDR and switch operating systems that send no logs. This profile covers the threat actor that MITRE ATT&CK tracks as G1047, active since at least 2021 and documented by the incident response firm Sygnia in 2024. It explains how the group kept access to one organisation for about three years through several independent footholds, how it later exploited a Cisco NX-OS zero-day with stolen switch administrator credentials, and what that means for appliance and network device security. It draws on MITRE ATT&CK v20, Sygnia's two reports, Cisco's security advisory and the CISA Known Exploited Vulnerabilities catalog, and follows each source's attribution wording. It is written for network, infrastructure and incident response teams. For the appliance problem in general, see the Edge Device Exploitation by Threat Actors Guide.

Key takeaways

• Removing one foothold is not eviction. Sygnia saw the actor pivot to another foothold each time one was removed, including dormant PlugX implants reactivated on legacy servers.
• Appliances are hosts. On F5 BIG-IP devices the group ran custom tools from /etc/rc.local, opened a reverse SSH tunnel and captured packets, all on the device's Linux layer.
• Network admin credentials are the key. The Cisco NX-OS flaw CVE-2024-20399 needs administrator credentials; ATT&CK records Velvet Ant using admin-level local accounts on the switches. Protect, vault and rotate those accounts like domain admin.
• Blind spots are chosen, not accidental. Windows Server 2003 systems without EDR, an unfinished disaster recovery project and switches that log only failed logins gave the actor places to hide.
• Egress and east-west controls do most of the work. Sygnia's recommendations centre on restricting outbound traffic from servers and devices and limiting SMB, RPC, WinRM, RDP and SSH between hosts.

Who they are (names and aliases)

MITRE ATT&CK describes Velvet Ant as a threat actor operating since at least 2021, associated with complex persistence mechanisms, targeting of network devices and appliances, and use of zero-day exploits. ATT&CK lists no other aliases. Sygnia, which named the group, says it showed behaviours like those of a China-nexus threat actor, while noting that shared tools and contractors make attribution difficult and that a false flag cannot be ruled out. Sygnia's July 2024 advisory refers to Velvet Ant as a China-nexus group. Microsoft's threat actor naming table does not list Velvet Ant at the time of writing. No government attribution was found in the sources read, and no individuals are named on this page. For the wider context, see the China State Cyber Operations Guide.

Tools and malware

For PlugX as a family, see the PlugX and ShadowPad Malware Guide and the Impacket Detection Guide.

Targeting and motivation

• Victims: Sygnia describes a large organisation and does not name its sector or region. Public reporting is therefore thin on victimology; treat any sector claim not backed by a primary source with caution.
• Motivation: long-term access consistent with espionage. Sygnia's language is about persistence and access to the network rather than theft for profit or disruption, and no source read describes destructive or extortion activity.
• What the group values: devices that sit inline and see traffic (load balancers, switches), legacy hosts outside EDR coverage, and internal servers that can relay C2 for hosts with no internet access.
• Who should care: any organisation running internet-facing F5 BIG-IP, Cisco Nexus or MDS switches, or unsupported Windows servers, and especially those with large flat internal networks.

How the intrusion was built

Three years, several footholds

Sygnia responded in late 2023 to an organisation where the actor had been present for about three years. Footholds included dormant PlugX on Windows Server 2003 systems and a file server, a PlugX variant whose C2 was an internal file server listening on port 13742, and two F5 BIG-IP appliances exposed directly to the internet. The appliances ran an outdated operating system and came from a disaster recovery project that was never finished and was not meant to be in production. Sygnia could not confirm how the appliances were first compromised because of limited visibility.

Living on the load balancer

On the F5 devices the actor added VELVETSTING and VELVETTAP to /etc/rc.local so they ran at boot, kept a reverse SSH tunnel to its C2, and used the appliance to reach the internal file server's PlugX listener over SMB. Because the load balancer sat at the network edge with legitimate reasons to talk to both sides, its traffic attracted little attention. See the F5 BIG-IP Hardening Guide and the Load Balancer Security Guide.

Windows tradecraft

On newer Windows workstations the actor tampered with EDR before installing PlugX; in one case where disabling EDR failed, it did not proceed. It used Impacket's wmiexec for execution, deleted EDR anti-malware logs, opened random high ports for PlugX listeners with netsh, and masqueraded a malicious DLL as the OLE/COM Object Viewer.

The Cisco NX-OS zero-day

Cisco published its advisory for CVE-2024-20399 on 1 July 2024, credited Sygnia with reporting it, and said it became aware of attempted exploitation in the wild in April 2024. The flaw is a command injection in the NX-OS CLI (CVSS 6.0) that lets an authenticated administrator run commands as root on the underlying operating system, and Cisco lists no workaround. Affected families named by Sygnia include MDS 9000, Nexus 3000, 5500, 5600, 6000, 7000 and Nexus 9000 in standalone mode. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2 July 2024. Sygnia attributes the exploitation to Velvet Ant; Cisco's advisory names no actor. The lesson is that the switch admin credential, not the vulnerability, was the gate. See the Vulnerability Management for Network Devices Guide.

Tactics and techniques (MITRE ATT&CK)

All IDs below are ATT&CK v20 techniques recorded against G1047. v20 places masquerading, DLL hijacking and exploitation for stealth under the Stealth tactic, and tool and firewall tampering under Defense Impairment.

How they abuse identities and credentials

• Network device administrator accounts: a local admin account on a switch behaves like a shared machine credential: often used by a team, rarely rotated and invisible to the identity provider. Put devices behind central AAA such as TACACS+, keep local accounts for break-glass only, store their passwords in a vault and rotate them. Cisco's advisory recommends monitoring and frequently changing the network-admin and vdc-admin credentials. See the TACACS+ Security guide and the Network Device Management Plane Hardening Guide.
• Appliance accounts and SSH keys: Sygnia saw a reverse SSH tunnel running under an account on the F5 device. Inventory local users and authorised keys on appliances and alert on new ones.
• Packet capture as credential collection: a load balancer that terminates or sees traffic can expose session tokens and cleartext credentials passing through it. Treat appliance compromise as a possible exposure of every service behind it and rotate those service credentials.
• Windows credentials: Sygnia recommends tamper-resistant EDR, LSASS running as a protected process and Windows Credential Guard to limit credential harvesting. See Credential Guard and VBS.

Notable activity

Detection and defence

What to monitor

See the Network Device Syslog and Configuration Change Detection Guide for collection details.

Phased response plan

1. Find the forgotten: inventory every appliance, switch and server, including disaster recovery and test kit, with its owner, OS version and internet exposure. Retire or isolate anything unowned. See the Operating System End of Life and Extended Support Guide.
2. Cut egress: block direct internet access from servers, switches and load balancers except named destinations, and place load balancers behind perimeter firewalls. Apply in monitor mode first and log what would be dropped, then enforce; keep the previous rule set for rollback.
3. Limit east-west: restrict SMB (445), RPC (135), WinRM (5985 and 5986), RDP (3389) and SSH (22) between hosts with host firewalls and segmentation, starting with workstation-to-workstation traffic.
4. Lock down device admin: central AAA, a hardened jump host or PAM with MFA as the only path to management interfaces, vaulted and rotated local admin passwords, and successful-login logging.
5. Patch and verify devices: upgrade NX-OS to a fixed release using Cisco's Software Checker, apply F5 updates, and run integrity checks on appliances after patching, since a patch does not remove an implant.
6. Plan eviction as one event: if compromise is found, map every foothold before acting, then remove them together, rotate device and service credentials, and hunt for re-entry for weeks afterwards. See the Edge Device Compromise Investigation Playbook.

Decision guidance

• Rebuild or clean an appliance: where the underlying OS was modified, rebuild from known-good images and restore configuration from a reviewed backup rather than deleting files in place.
• Legacy servers you cannot retire: isolate them in their own segment, allow only the flows they need, deploy whatever monitoring runs on them (Sysmon where supported) and watch their traffic closely.
• Small organisations: consider managed or cloud load balancing and a managed firewall so no self-run appliance is internet-facing, and keep device admin behind a VPN with MFA.
• Large organisations: add scheduled threat hunts on network devices, NetFlow analytics for traffic from infrastructure, and integrity attestation for appliances.

Metrics

• Number of internet-exposed management interfaces on appliances and switches (target zero).
• Percentage of network devices sending successful and failed authentication logs to the SIEM.
• Percentage of device local admin passwords held in a vault and rotated in the last 90 days.
• Number of servers and devices with unrestricted outbound internet access.
• Number of unsupported operating systems in production, and the percentage isolated.

Framework mapping

Common failure patterns

• Partial eviction: cleaning the endpoint that raised the alert while dormant implants on legacy servers and appliances wait to be reactivated.
• Abandoned projects left live: half-built disaster recovery or test devices exposed to the internet with no owner and no patching.
• Switch logs that only record failures: a successful login with stolen admin credentials leaves no trace centrally.
• Shared, static device passwords: one stolen switch credential opens every device that uses it.
• Trusting infrastructure traffic: load balancers and switches are excluded from egress rules and anomaly detection because they "always talk to everything".

Practitioner checklist

• Inventory all appliances and switches, including disaster recovery and test devices, with owners.
• Remove internet exposure of management interfaces and place load balancers behind firewalls.
• Block outbound internet from servers and network devices except named destinations.
• Restrict SMB, RPC, WinRM, RDP and SSH between hosts.
• Use central AAA for device admin; vault and rotate local admin passwords.
• Log successful device logins and configuration changes to the SIEM.
• Upgrade NX-OS to a fixed release for CVE-2024-20399 and keep F5 software current.
• Check appliance start-up files, local users and SSH keys regularly.
• Enable EDR tamper protection, LSASS protection and Credential Guard on Windows.
• Isolate or retire Windows Server 2003 and other unsupported systems.

Standards and references

• MITRE ATT&CK: Velvet Ant (G1047)
• Sygnia: China-Nexus Threat Group Velvet Ant Abuses F5 Load Balancers for Persistence
• Sygnia: China-Nexus Threat Group Velvet Ant Exploits Cisco Zero-Day (CVE-2024-20399)
• Cisco: Cisco NX-OS Software CLI Command Injection Vulnerability
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: PlugX (S0013)
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: ATT&CK Network Device Malware Software Hub · ATT&CK Remote Access Trojans Software Hub · ATT&CK Credential and Active Directory Attack Tools Software Hub · Edge Device Security Guide · F5 BIG-IP Hardening Guide · PlugX and ShadowPad Malware Guide · China State Cyber Operations Guide · MITRE ATT&CK T1211 Exploitation for Stealth