China's 'Velvet Ant' APT Nests Inside Multiyear Espionage Effort

Researchers uncovered a multiyear Velvet Ant (China-linked) espionage campaign against a large East Asian company that achieved remarkable persistence by infecting legacy and unmonitored systems (including Windows Server 2003 and F5 Big‑IP appliances). The actor deployed PlugX RAT (with both external and internal C2 configurations), used Impacket/wmiexec for lateral movement, disabled EDR and erased logs, and created dormant fallback strongholds so that remediation efforts repeatedly failed to fully evict them.