MalwareUsed by 2 actors

VelvetCake

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules.

via socradar blogsocradar.io

KONNI

VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules.

via socradar blogsocradar.io

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Initial access was likely established through spear-phishing emails containing ZIP attachments. These archives contained LNK files masquerading as PDFs.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.

T1059.001PowerShellEvidence1

The malicious LNK file executes a PowerShell command to download and store two payloads... update2.ps1... is the actual VelvetCake downloader.

T1204.002Malicious FileEvidence1

The threat actors convinced targets to download the installer from attacker-controlled infrastructure under the guise of attending a meeting. | Upon execution, the LNK files deploy a custom PowerShell downloader dubbed VelvetCake.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.

Stealth

2 techniques

T1036MasqueradingEvidence1

The ZIP archives contain LNK files disguised as PDF documents featuring socio-economic themes.

T1070.004File DeletionEvidence1

Purges local output files... and then deletes the downloaded payload script... Deletes all local temporary files immediately following successful transmission.

Discovery

5 techniques

T1016System Network Configuration DiscoveryEvidence1

Gathers environment details using systeminfo and ipconfig /all.

T1057Process DiscoveryEvidence1

User & Process Activity: Enumerates active processes via Get-Process.

T1082System Information DiscoveryEvidence1

Gathers environment details using systeminfo and ipconfig /all.

T1083File and Directory DiscoveryEvidence1

Collects recently accessed files using Get-ChildItem ([Environment]::GetFolderPath(‘Recent’)) and maps available disk drives using Get-PSDrive.

T1518.001Security Software DiscoveryEvidence1

Antivirus Inventory: Queries installed security products via the root/SecurityCenter 2 WMI namespace.

Collection

2 techniques

T1074Data StagedEvidence1

Writes collected system metadata and display captures into timestamped text (.txt) and image (.png) files within %TMP%.

T1113Screen CaptureEvidence1

Display Capture: Captures a full image of the virtual display leveraging .NET Windows Forms and Drawing assemblies.

Command and Control

2 techniques

T1095Non-Application Layer ProtocolEvidence1

VelvetCake initiates communication by establishing a raw TCP connection to 111[.]92[.]246[.]145:12345 and authenticates using the command PASSWORD MySecurePass123.

T1105Ingress Tool TransferEvidence1

The LNK files download the primary payloads alongside a decoy document from remote servers... VelvetCake... downloads available payload scripts.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltrates newly created files back to the C2 server using a custom UPLOAD <filename> command... Exfiltrates the staged files via HTTP POST requests.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

socradar blogNews

Sep 22, 2026

VelvetCake: Konni Targets Ukraine With Malicious LNK Files

A modular PowerShell-based downloader and task-queue runner delivered through malicious LNK files and trojanized Zoom installers. It persists through a scheduled task, retrieves PowerShell scripts from its C2, executes them, collects generated output, exfiltrates it, and removes local artifacts. Its second-stage scripts perform host reconnaissance, inventory antivirus products, collect network and process information, capture screenshots, and exfiltrate staged files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

VelvetCake

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules.

via socradar blogsocradar.io

KONNI

VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules.

via socradar blogsocradar.io

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Initial access was likely established through spear-phishing emails containing ZIP attachments. These archives contained LNK files masquerading as PDFs.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.

T1059.001PowerShellEvidence1

The malicious LNK file executes a PowerShell command to download and store two payloads... update2.ps1... is the actual VelvetCake downloader.

T1204.002Malicious FileEvidence1

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.

Stealth

2 techniques

T1036MasqueradingEvidence1

The ZIP archives contain LNK files disguised as PDF documents featuring socio-economic themes.

T1070.004File DeletionEvidence1

Purges local output files... and then deletes the downloaded payload script... Deletes all local temporary files immediately following successful transmission.

Discovery

5 techniques

T1016System Network Configuration DiscoveryEvidence1

Gathers environment details using systeminfo and ipconfig /all.

T1057Process DiscoveryEvidence1

User & Process Activity: Enumerates active processes via Get-Process.

T1082System Information DiscoveryEvidence1

Gathers environment details using systeminfo and ipconfig /all.

T1083File and Directory DiscoveryEvidence1

Collects recently accessed files using Get-ChildItem ([Environment]::GetFolderPath(‘Recent’)) and maps available disk drives using Get-PSDrive.

T1518.001Security Software DiscoveryEvidence1

Antivirus Inventory: Queries installed security products via the root/SecurityCenter 2 WMI namespace.

Collection

2 techniques

T1074Data StagedEvidence1

Writes collected system metadata and display captures into timestamped text (.txt) and image (.png) files within %TMP%.

T1113Screen CaptureEvidence1

Display Capture: Captures a full image of the virtual display leveraging .NET Windows Forms and Drawing assemblies.

Command and Control

2 techniques

T1095Non-Application Layer ProtocolEvidence1

VelvetCake initiates communication by establishing a raw TCP connection to 111[.]92[.]246[.]145:12345 and authenticates using the command PASSWORD MySecurePass123.

T1105Ingress Tool TransferEvidence1

The LNK files download the primary payloads alongside a decoy document from remote servers... VelvetCake... downloads available payload scripts.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltrates newly created files back to the C2 server using a custom UPLOAD <filename> command... Exfiltrates the staged files via HTTP POST requests.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

socradar blogNews

Sep 22, 2026

VelvetCake: Konni Targets Ukraine With Malicious LNK Files

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.