← All Threat Actors
Threat Actor Profile

Velvet Ant

G1047
▲ High Threat
Velvet Ant (G1047) is a sophisticated threat actor, likely state-sponsored, that focuses on high-impact cyber espionage. The group is characterized by its ability to conduct stealthy, long-term intelligence collection operations against high-value strategic targets.
Origin
Motivation espionage

Target Sectors

government defense technology telecommunications research institutions

Known TTPs

spearphishing
custom malware deployment
living-off-the-land (LotL)
credential access
command and control (C2)
exfiltration over C2 channels

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD