China-Linked Velvet Ant Group Backdoored Linux Login Software to Evade Detection for Nearly a Decade
A China-linked hacking group known as Velvet Ant compromised Linux PAM and OpenSSH components to maintain undetected access to a target network for nearly a decade.
A China-linked hacking group tracked as Velvet Ant has been found to have backdoored Linux PAM and OpenSSH components, allowing them to maintain undetected access to a target network for nearly a decade. According to researchers at Sygnia, the group compromised the authentication layer itself, planting backdoors that evaded standard cleanup and forensic tools. The campaign, dubbed Operation Highland, targeted an unnamed network with no direct internet access, forcing the attackers to first stage through internet-facing systems.
The earliest traces of the operation date back to 2016. Instead of deploying new malware that could be detected by scanners, the attackers modified the trusted login programs themselves. On many machines, they replaced the main PAM login module with backdoored copies that either allowed access with a secret password or quietly recorded legitimate usernames and passwords. Researchers identified nine separate versions of the backdoored modules. Similarly, OpenSSH programs were altered to log credentials and every command typed, with a hidden switch to disable logging when needed.
Reaching the isolated network required additional effort. The attackers used disguised tools and an internet-facing web server as a bridge, passing commands through it to open remote sessions deep inside the segment that had no direct internet access. Because the login system itself was compromised, normal containment measures like password resets and session kills were ineffective. The backdoor persisted even after such actions, as the credential-checking mechanism was working for the attacker.
This is not the first time Velvet Ant has employed such tactics. In a 2024 case, Sygnia found the same actor turning internet-exposed F5 BIG-IP appliances into internal command servers. Later that year, the group exploited a Cisco NX-OS flaw, CVE-2024-20399, to plant a backdoor on switches. That bug required admin access first, making it a persistence tool rather than a remote break-in. Cisco patched it in July 2024, and CISA flagged it as exploited the next day.
Operation Highland represents a deeper level of persistence by targeting the login software itself. Load balancers, switches, and the login layer are trusted by default and rarely checked, making them ideal hiding spots for patient attackers. The fix for this type of compromise is not patching but verification: administrators must monitor PAM and OpenSSH programs for any changes and compare them against known-good copies. Removing the backdoor before resetting passwords is critical, as new credentials would otherwise be stolen the same way.
The wider lesson is clear: infrastructure that sits outside normal monitoring still needs integrity checks, and that now includes the login layer. Organizations should watch login files, hunt for changes rather than waiting for alerts, and test any replacements in a lab first. The earlier F5 and Cisco cases have their own checks: patch CVE-2024-20399 on Cisco Nexus gear and watch F5 boxes for unexpected outbound connections.
Sygnia researchers have now published a detailed breakdown of the decade-long campaign, dubbed "Operation Highland," revealing that Velvet Ant hijacked the target's identity provider by replacing legitimate Linux PAM and OpenSSH components with backdoored versions that accepted hardcoded passwords and harvested credentials. The attackers established a remote execution path into an air-gapped network by chaining modifications to internet-facing Nginx servers and a FastCGI wrapper, enabling persistent access without ever requiring a direct connection to the isolated environment. Sygnia identified nine distinct variants of the malicious PAM module, each compiled in a separate build environment, underscoring the group's significant resources.
Sygnia's Operation Highland investigation, detailed in a report shared with Cyber Security News, reveals that Velvet Ant backdoored the Linux PAM module pam_unix.so on nine compromised hosts, accepting a hardcoded backdoor password while harvesting legitimate credentials. The attackers also deployed a modified GS-Netcat reverse shell disguised as 'auditd' and used systemd unit files for persistence, with forensic artifacts tracing back to 2017. The report provides specific indicators of compromise, including file paths and process names, enabling defenders to hunt for the intrusion.
Sygnia's forensic report, published on June 15, 2026, reveals that the group backdoored nine distinct variants of the pam_unix.so module, each compiled in a separate environment, and modified OpenSSH binaries to capture credentials from both incoming and outgoing connections while logging all commands typed during active sessions. The attackers also appended their own keys to authorized_keys files for password-free access that would survive full password rotations. Sygnia noted that evicting Velvet Ant required replacing the entire authentication stack across multiple Linux distributions, a process fraught with risk of locking administrators out of critical systems.