Velvet Team

Velvet Team is a hacktivist collective that became publicly visible in early 2025 through a sequence of denial-of-service claims against government, military, intelligence and symbolic targets. Cyble reports that Velvet Team collaborated with Mr Hamza in a series of DDoS attacks against U.S. government and military platforms, including an Army development and communications network, an FBI information portal and the official United States Africa Command platform.

The group's strongest independently described incident is a DDoS claim against the Romanian Intelligence Service (SRI) under Op_EAAI. Romanian reporting states that SRI's cyber structure blocked the attacks and that the website was not endangered, with no data theft or compromise. This is analytically important because it distinguishes attack intent and traffic generation from successful intrusion or data-access claims.

Hackmanac activity tracking expands the victim set to the Romanian Foreign Intelligence Service, Sweden's Security Service, U.S. Africa Command, a Venezuelan regional tax-administration service and several commercial/adult-content sites. The resulting victimology is broad but contains a notable concentration of government, military, intelligence and public-institution targets.

Collection context identifies V3lV3t Team as an alias and g1itch as an administrator. These identifiers are useful for future entity resolution but remain collection-derived in the absence of a recoverable actor-controlled channel or independent public source connecting g1itch to Velvet Team.

Key judgment — high confidence: Velvet Team is best characterized as an availability-focused hacktivist actor whose strongest demonstrated behavior is DDoS and whose operational relevance is amplified by coalition activity with larger or better-documented partners such as Mr Hamza.