Key Takeaways
- The China‑nexus group Velvet Ant has been embedding backdoors in core Linux authentication components (PAM and OpenSSH) since at least 2016.
- Rather than dropping detectable malware, the attackers replaced trusted binaries, allowing them to harvest credentials or gain covert access without triggering typical security alerts.
- Their intrusion path began on internet‑facing systems, using a compromised web server as a bridge to reach an otherwise isolated internal network.
- Because the login subsystem itself is compromised, routine remediation steps such as password resets or killing sessions are ineffective; the attacker controls the very mechanism that validates those actions.
- Velvet Ant demonstrates a pattern of persistence: when defenders close one foothold, the group moves to less‑monitored infrastructure (e.g., F5 BIG‑IP load balancers, Cisco Nexus switches).
- Effective defense requires integrity monitoring of authentication binaries, testing replacements in isolated labs before deployment, and removing backdoors before credential rotation.
- The broader lesson is that any trusted component—no matter how low‑level or infrequently inspected—must be subjected to regular integrity checks, especially in air‑gapped or segmented environments.
Background of the Velvet Ant Intrusion
Sygnia tracks a China‑linked threat actor it calls Velvet Ant, which has operated covertly for close to a decade. Instead of planting obvious malware on endpoints that defenders monitor, the group chose to subvert the Linux login stack itself. By compromising the Pluggable Authentication Modules (PAM) and OpenSSH binaries, Velvet Ant gained a foothold that survives standard cleanup procedures, password changes, and session terminations. The earliest forensic traces of this activity date back to 2016, indicating a long‑term, patient campaign focused on persistence rather than quick exploitation.
How the Backdoor Was Implemented
The attackers replaced the legitimate PAM login module with trojanized versions on numerous hosts. Some of these altered modules accepted a secret hard‑coded password, granting the intruders immediate access. Others silently harvested usernames and passwords as legitimate users logged in, exfiltrating the credentials later. In parallel, the OpenSSH server binaries were modified to log every command typed during a session and to capture authentication data, with a hidden toggle that enables or disables this logging on demand. Researchers identified nine distinct variants of these backdoored components, showing that the group iterated on its tools to evade detection while maintaining functionality.
Reaching the Isolated Network
The target environment had no direct connection to the internet, forcing Velvet Ant to devise a multi‑stage ingress path. First, the actors compromised internet‑facing assets—such as a web server—using previously obtained credentials or exploits. From there, they used the compromised host as a relay, forwarding commands through it to deep internal segments that were air‑gapped from the outside world. This “jump‑host” technique allowed the attackers to traverse network zones without exposing their tools to perimeter defenses, illustrating a classic defense‑in‑depth bypass.
Why Traditional Containment Fails
Because the authentication mechanisms themselves are under attacker control, standard incident‑response actions lose effectiveness. Resetting a user’s password does not help when the PAM module that checks that password is programmed to accept a backdoor credential. Killing active sessions merely forces the user to re‑authenticate, which the compromised login service will still allow the intruder to bypass. In essence, the defender is fighting an adversary that holds the keys to the kingdom’s front door, making superficial remediation insufficient.
Velvet Ant’s Persistence Playbook
The group’s modus operandi is not a one‑off trick; it is a repeatable strategy of moving to less‑watched layers each time a foothold is discovered. In 2024, Sygnia observed Velvet Ant repurposing exposed F5 BIG‑IP appliances as internal command‑and‑control servers after gaining initial access. Later that year, the actors exploited a vulnerability in Cisco NX‑OS (CVE‑2024‑20399) to plant a backdoor on network switches. Although the Cisco flaw required prior administrative privileges, once exploited it served as a persistence mechanism rather than a remote entry point. Cisco issued a patch in July 2024, and CISA flagged the flaw as actively exploited the following day, underscoring how quickly the group adapts to newly disclosed weaknesses.
Operation Highland: Deeper Trust Abuse
Sygnia labels the current campaign “Operation Highland,” emphasizing that the attackers have gone one level deeper into the trust hierarchy. Load balancers, core switches, and now the login software itself are components that organizations typically consider “trusted by default” and therefore subject to minimal integrity verification. By embedding malicious code in these low‑level, rarely audited pieces, Velvet Ant ensures its presence survives routine patch cycles, configuration audits, and even full operating‑system reinstallations that leave the underlying binaries untouched.
The Limits of Patch‑Centric Thinking
Operation Highland illustrates that simply applying vendor patches is insufficient when the adversary modifies the very code that patches are meant to protect. Since the attackers altered the PAM and OpenSSH binaries after gaining initial access, the corrective action is not merely to apply a security update but to verify the integrity of those binaries, replace any tampered copies with known‑good versions, and validate that the replacements do not inadvertently lock out legitimate administrators. This verification‑centric approach is delicate: an incorrect replacement can render a system inaccessible, highlighting the need for rigorous testing in a lab before production deployment.
Practical Defense Recommendations
Defenders should adopt a proactive integrity‑monitoring regime for authentication‑critical files. Specific steps include:
- Continuously monitoring PAM and OpenSSH binaries (and their associated configuration files) for unauthorized changes, triggering alerts on any modification.
- Conducting regular hash‑based comparisons against a trusted baseline to detect stealthy alterations that evade signature‑based scanners.
- Removing any discovered backdoors before resetting passwords or rotating credentials, to prevent the new secrets from being harvested immediately.
- Validating replacement binaries in an isolated laboratory environment to ensure they restore normal functionality without introducing lock‑out scenarios.
For the earlier F5 and Cisco incidents, complementary mitigations apply: promptly apply the patch for CVE‑2024‑20399 on Cisco Nexus devices and monitor F5 BIG‑IP appliances for anomalous outbound traffic that could indicate command‑and‑control activity.
Broader Implication for Infrastructure Security
The Velvet Ant case reinforces a fundamental truth: any component that sits outside the usual monitoring radar—whether it is a firmware module, a low‑level library, or a trusted service binary—must be subject to integrity verification. In segmented or air‑gapped networks, where defenders assume safety through isolation, attackers can still achieve persistence by compromising the very mechanisms that gate access. Organizations must therefore expand their security baselines to include cryptographic signing, immutable storage, or secure boot mechanisms for critical authentication software, and they must treat the login layer as a high‑value target worthy of continuous scrutiny.
In summary, Velvet Ant’s decade‑long campaign demonstrates how patient adversaries can subvert core Linux authentication controls to maintain stealthy, resilient access. Effective defense hinges on vigilant integrity monitoring, careful validation of replacement components, and a shift from pure patch‑management to a holistic verification posture that protects even the most trusted, low‑level infrastructure.