Trusted Design

Velvet Ant

アクターID: G1047

· MITRE Pageへのリンク

脅威アクターの詳細

Velvet Ant is a threat actor operating since at least 2021. Velvet Ant is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.(Citation: Sygnia VelvetAnt 2024A)(Citation: Sygnia VelvetAnt 2024B)

脅威アクターの別名・別称

Velvet Ant

利用した攻撃手法

• T1047 - Windows Management Instrumentation
• T1123 - Audio Capture
• T1218.013 - Mavinject
• T1089 - Disabling Security Tools
• T1583.005 - Botnet
• T1036.009 - Break Process Trees
• T1684 - Social Engineering
• T1032 - Standard Cryptographic Protocol
• T1009 - Binary Padding
• T1219.001 - IDE Tunneling
• T1055.004 - Asynchronous Procedure Call
• T1686.002 - Network Device Firewall
• T1597 - Search Closed Sources
• T1562.001 - Disable or Modify Tools
• T1128 - Netsh Helper DLL
• T1566.004 - Spearphishing Voice
• T1614 - System Location Discovery
• T1219.002 - Remote Desktop Software
• T1027.007 - Dynamic API Resolution
• T1569.002 - Service Execution
• T1490 - Inhibit System Recovery
• T1566.003 - Spearphishing via Service

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.007)
• CVE-2017-0143 (T1027.007)
• CVE-2015-1770 (T1566.003)
• CVE-2014-6332 (T1027.007)
• CVE-2012-0158 (T1027.007)
• CVE-2012-4792 (T1219.001)
• CVE-2014-1776 (T1597)
• CVE-2010-0806 (T1219.001)
• CVE-2015-7645 (T1583.005)
• CVE-2015-3043 (T1219.001)
• CVE-2016-1010 (T1219.001)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1686.002)
• CVE-2016-9494 (T1597)
• CVE-2016-9496 (T1009)
• CVE-2016-9495 (T1009)
• CVE-2017-0261 (T1055.004)
• CVE-2015-0311 (T1219.001)
• CVE-2015-0336 (T1219.001)
• CVE-2015-0310 (T1597)
• CVE-2014-0556 (T1597)
• CVE-2014-8440 (T1219.001)
• CVE-2010-1297 (T1597)
• CVE-2013-0634 (T1597)
• CVE-2014-1761 (T1036.009)
• CVE-2015-1641 (T1219.001)
• CVE-2014-0329 (T1597)
• CVE-2010-3333 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2010-2884 (T1597)
• CVE-2010-2883 (T1036.009)
• CVE-2010-0232 (T1597)
• CVE-2009-3129 (T1597)
• CVE-2011-0611 (T1597)
• CVE-2025-24893 (T1597)
• CVE-2014-4113 (T1027.007)
• CVE-2015-1701 (T1027.007)
• CVE-2015-0016 (T1219.001)
• CVE-2015-2360 (T1027.007)
• CVE-2015-5119 (T1219.001)
• CVE-2015-5122 (T1219.001)
• CVE-2015-1427 (T1009)
• CVE-2012-1856 (T1027.007)
• CVE-2017-12149 (T1009)
• CVE-2015-4495 (T1219.001)
• CVE-2014-6271 (T1597)
• CVE-2013-2094 (T1009)
• CVE-2015-3628 (T1219.001)
• CVE-2015-6034 (T1597)
• CVE-2015-2853 (T1219.001)
• CVE-2015-7755 (T1009)
• CVE-2015-7261 (T1009)
• CVE-2015-8286 (T1009)
• CVE-2016-6532 (T1009)
• CVE-2015-0932 (T1009)
• CVE-2012-0056 (T1055.004)
• CVE-2010-3081 (T1219.001)
• CVE-2012-3213 (T1219.001)
• CVE-2014-0322 (T1027.007)
• CVE-2011-3544 (T1219.001)
• CVE-2015-3636 (T1597)
• CVE-2017-17215 (T1219.001)
• CVE-2012-4681 (T1009)
• CVE-2015-1761 (T1219.001)
• CVE-2013-7331 (T1569.002)
• CVE-2013-2678 (T1219.001)
• CVE-2008-1436 (T1490)
• CVE-2014-3393 (T1597)
• CVE-2012-6422 (T1597)
• CVE-2014-3897 (T1219.001)
• CVE-2013-5990 (T1219.001)
• CVE-2015-2419 (T1219.001)
• CVE-2016-0189 (T1219.001)
• CVE-2025-31125 (T1219.001)
• CVE-2025-66478 (T1219.001)
• CVE-2026-20127 (T1597)
• CVE-2015-2545 (T1027.007)
• CVE-2015-2546 (T1597)
• CVE-2015-3785 (T1597)
• CVE-2015-5897 (T1597)
• CVE-2017-0199 (T1027.007)
• CVE-2015-3090 (T1219.001)
• CVE-2015-3113 (T1219.001)
• CVE-2015-2590 (T1686.002)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1219.001)
• CVE-2015-2502 (T1027.007)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1219.001)
• CVE-2016-1019 (T1219.001)
• CVE-2016-0984 (T1597)
• CVE-2015-0313 (T1219.001)
• CVE-2015-0359 (T1219.001)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2012-4969 (T1027.007)
• CVE-2015-6022 (T1219.001)
• CVE-2017-0263 (T1597)
• CVE-2017-0262 (T1055.004)
• CVE-2025-55182 (T1597)
• CVE-2012-1258 (T1055.004)
• CVE-2014-3153 (T1597)
• CVE-2014-4322 (T1597)
• CVE-2013-6282 (T1597)
• CVE-2015-3105 (T1597)
• CVE-2017-16929 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2014-8439 (T1219.001)
• CVE-2013-2551 (T1219.001)
• CVE-2010-0188 (T1219.001)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2012-1876 (T1219.001)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0057 (T1027.007)
• CVE-2012-2539 (T1055.004)
• CVE-2015-0071 (T1219.001)
• CVE-2014-9163 (T1219.001)
• CVE-2012-1723 (T1219.001)
• CVE-2013-3660 (T1597)
• CVE-2014-4148 (T1027.007)
• CVE-2011-3402 (T1597)
• CVE-2014-6324 (T1597)
• CVE-2014-7247 (T1219.001)
• CVE-2015-2426 (T1597)
• CVE-2010-4398 (T1597)
• CVE-2014-2273 (T1597)
• CVE-2015-4902 (T1219.001)
• CVE-2015-2387 (T1597)
• CVE-2010-2572 (T1686.002)
• CVE-2011-1255 (T1219.001)
• CVE-2017-8570 (T1219.001)
• CVE-2012-0611 (T1597)
• CVE-2016-4117 (T1219.001)
• CVE-2017-0001 (T1219.001)
• CVE-2023-1389 (T1219.001)
• CVE-2025-34026 (T1597)
• CVE-2025-55183 (T1597)
• CVE-2025-55184 (T1597)
• CVE-2025-68645 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2016-1287 (T1597)
• CVE-2016-2342 (T1055.004)
• CVE-2025-13928 (T1055.004)
• CVE-2015-3456 (T1597)
• CVE-2016-1562 (T1597)
• CVE-2017-3212 (T1597)
• CVE-2014-7911 (T1597)
• CVE-2013-2595 (T1597)
• CVE-2017-7255 (T1597)
• CVE-2025-13335 (T1562.001)
• CVE-2014-6352 (T1027.007)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る