Threadlinqs IntelligenceStart free

Threat actorChinaTracked since 2026-06

Velvet Ant

Also known as:G1047

As of 2026-07-14, Velvet Ant is a China-nexus threat actor tracked by Threadlinqs Intelligence across 3 threats spanning campaign, malware. Also known as G1047. ATT&CK coverage spans 58 techniques across 13 tactics in 3 of 3 tracked threats. Most-observed techniques: T1071.001 (Web Protocols), T1190 (Exploit Public-Facing Application), T1003 (OS Credential Dumping).

Tracked threats
31 critical · 1 high · 1 medium
First seen
2026-06-15
Last seen
2026-07-14
ATT&CK techniques
58across 3 of 3 threats
Related CVEs
1Referenced by its activity
Attribution
ChinaNation or origin
Nation: China · 3 tracked threat(s) · Categories: CAMPAIGN, MALWARE

Activity timeline

Velvet Ant appears in 3 tracked threats between and ; the busiest month was 2026-06 with 2 reports.

ATT&CK techniques observed

58 techniques observed across 3 of 3 tracked threats · Stealth (formerly Defense Evasion) (11), Command and Control (9), Credential Access (8), Initial Access (7), Persistence (7), Defense Impairment (4)
  • T1071.001 Web Protocols — Command and Controlobserved in 3 of 3 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 3 of 3 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 2 of 3 tracked threats
  • T1005 Data from Local System — Collectionobserved in 2 of 3 tracked threats
  • T1021.004 SSH — Lateral Movementobserved in 2 of 3 tracked threats
  • T1036.005 Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion)observed in 2 of 3 tracked threats
  • T1056.001 Keylogging — Credential Accessobserved in 2 of 3 tracked threats
  • T1059.004 Unix Shell — Executionobserved in 2 of 3 tracked threats
  • T1070.006 Timestomp — Stealth (formerly Defense Evasion)observed in 2 of 3 tracked threats
  • T1090 Proxy — Command and Controlobserved in 2 of 3 tracked threats
  • T1098.004 SSH Authorized Keys — Persistenceobserved in 2 of 3 tracked threats
  • T1105 Ingress Tool Transfer — Command and Controlobserved in 2 of 3 tracked threats
  • T1199 Trusted Relationship — Initial Accessobserved in 2 of 3 tracked threats
  • T1543.002 Systemd Service — Persistenceobserved in 2 of 3 tracked threats
  • T1554 Compromise Host Software Binary — Persistenceobserved in 2 of 3 tracked threats

Tracked threats

Related CVEs

1 CVE referenced by tracked Velvet Ant activity