Sygnia managed to reconstruct the VELVETSHELL malware from device memory despite the threat actor’s efforts to delete it. The malware is a hybrid of two open-source tools, TinyShell and 3proxy, combined into a single binary. VELVETSHELL supports multiple capabilities, including executing arbitrary commands, downloading and uploading files, and establishing network traffic tunnels. These functionalities allowed the threat actor to maintain persistent access and control over the compromised system, facilitating data exfiltration and ongoing espionage activities.<\/p>\n\n\n\n

“Over the years of espionage activities \u2018Velvet Ant\u2019 increased their sophistication, using evolving tactics to continue their cyber operations in a victim network \u2013 from operating on ordinary endpoints, shifting operations to legacy servers and finally moving towards network appliances and using 0-days.” concludes the report that includes Indicators of Compromise (IoCs). “The determination, adaptability and persistence of such threat actors highlights the sensitivity of a holistic response plan to not only contain and mitigate the threat but also monitor the network for additional attempts to exploit the network.”<\/em><\/p>\n\n\n\n