The China-linked threat actor known as Velvet Ant exploited a zero-day vulnerability in Cisco Nexus switches, enabling them to gain complete control over affected systems to conduct espionage operations with heightened stealth and persistence. This vulnerability, tracked as CVE-2024-20399 (which has since been patched), allows attackers with valid administrator credentials to bypass the NX-OS command line interface (CLI) and access the underlying Linux-based operating system, a layer typically concealed from users and security tools. Once inside, Velvet Ant executed malicious scripts, including a custom payload named “VelvetShell”, which is a fusion of the Unix backdoor “TinyShell” and the proxy utility “3proxy”. This malware provided the attackers with capabilities to execute arbitrary commands, transfer files, and establish tunnels for proxying network traffic, effectively allowing them to control the compromised systems and maintain long-term access. Velvet Ant’s tactics involved infiltrating new Windows systems before moving to legacy servers and network devices, strategically escalating their evasion techniques to avoid detection by conventional security measures. By compromising edge devices like the Cisco Nexus switches, which are often designed with limited user access and visibility, the attackers were able to operate within the network undetected, pivoting directly to other devices without triggering alarms associated with lateral movement. This incident underscores the growing threat posed by sophisticated actors targeting network appliances, which, due to their “black box” design and limited visibility, present significant challenges for cybersecurity defenses and highlight the critical need for enhanced monitoring and security measures around such devices. CTIX analysts urge all Cisco Nexus customers to ensure that their products are up-to-date.