Sygnia VelvetAnt 2024A

Velvet Ant has transferred tools within victim environments using SMB.

Velvet Ant used a malicious DLL, `iviewers.dll`, that mimics the legitimate "OLE/COM Object Viewer" within Windows.

Velvet Ant used a modified `/etc/rc.local` file on compromised F5 BIG-IP devices to maintain persistence.

Velvet Ant has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.

Impacket's `wmiexec` module can be used to execute commands through WMI.

Velvet Ant used the `wmiexec.py` tool within Impacket for remote process execution via WMI.

Velvet Ant has enumerated existing network connections on victim devices.

Velvet Ant initial execution included launching multiple `svchost` processes and injecting code into them.

Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.

Velvet Ant has used reverse SSH tunnels to communicate to victim devices.

Velvet Ant has enumerated local files and folders on victim devices.

Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.

Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.

Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.

Velvet Ant executed and installed PlugX as a Windows service.

Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.

Impacket has used its `wmiexec` command, leveraging Windows Management Instrumentation, to remotely stage and execute payloads in victim networks.

Velvet Ant has used random high number ports for PlugX listeners on victim devices.

PlugX has used random, high-number, non-standard ports to listen for subsequent actions and C2 activities.

Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.

Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.

Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.

PlugX has modified local firewall rules on victim machines to enable a random, high-number listening port for subsequent access and C2 activity.

Velvet Ant modified system firewall settings during PlugX installation using `netsh.exe` to open a listening, random high number port on victim devices.