Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence
Velvet Ant (Operation Highland) (TL-2026-0807), also tracked as Operation Highland, is a critical-severity malware campaign, first published 2026-06-15. It is attributed to Velvet Ant (China) with high confidence, affects Linux-PAM pam_unix.so (Pluggable Authentication Modules), maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1021.004), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-0807
- Threat ID
- TL-2026-0807
- Also known as
- Operation Highland
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-15
- Last reviewed
- 2026-06-15
- Attribution
- Velvet Ant
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- critical infrastructure, government
- Target regions
- Asia
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Velvet Ant (Operation Highland)
Malware and tooling: F5 BIG-IP internal C2, Netcat, ssspl
China-nexus espionage actor Velvet Ant (G1047) maintained nearly ten years of undetected access to a segregated critical-infrastructure network by backdooring the Linux authentication layer rather than dropping conventional malware. Sygnia's investigation, dubbed Operation Highland, found nine separately-compiled pam_unix.so variants enabling password bypass and credential harvesting, modified OpenSSH binaries that captured credentials and keylogged sessions into encrypted hidden files, a modified GS-Netcat reverse shell, a Perl ssspl-based SOCKS5 proxy, an HTTP-POST-driven SSH tunneling binary fronted by Nginx/FastCGI, and authorized_keys injection.
How Velvet Ant (Operation Highland) works
Sygnia disclosed Operation Highland on 2026-06-15, attributing it to the China-nexus group Velvet Ant (MITRE G1047), an actor known for stealthy multi-year persistence. The campaign is notable because it contained no novel exploit and no obviously malicious dropper: the adversary subverted the components that perform authentication itself, so password resets and session terminations were ineffective because the very code validating credentials was working for the attacker.
Stage 1 (internet-facing foothold): Velvet Ant deployed a modified GS-Netcat utility as a binary named 'auditdb' in /usr/sbin/, masquerading via argv[0] as the kernel thread '[khubd]' and beaconing encrypted reverse shells to single-character subdomains of gs.thc[.]org. Persistence was established through a malicious systemd unit in /lib/systemd/system/ disguised as a Chrome service and via injection into /etc/init.d/ SysVinit scripts. A custom Perl SOCKS5 proxy derived from the public 'ssspl' project (process name 'smbd -D', unique port/filename per sample) provided bidirectional tunneling.
Stage 2 (pivot to isolated IT network): Internet-facing Nginx proxied requests to a backend Nginx instance forwarding to a local FastCGI process (fcgiwrap), which executed a custom SSH-tunnel binary named 'uptime' that accepted HTTP POST parameters and opened SSH connections into the air-gapped critical-infrastructure segment, executing remote scripts to retrieve confidential data without any direct external connectivity.
Stage 3 (authentication-layer compromise): Nine distinct backdoored pam_unix.so variants were identified, each compiled in a separate environment (distinguished by unique RPATH strings such as /home/kevin/Desktop/Linux-PAM-<ver>/libpam/.libs:/lib64 and /c/src/Linux-PAM-<ver>/libpam/.libs). Variants either accepted a hardcoded backdoor password (verified inside pam_sm_authenticate then NULL-overwritten, producing no logs) or harvested every credential to /usr/sbin/.ssh.log in [username]:[password] form, using an encrypted constant 'Pamauth@123456'. Modified OpenSSH binaries (a newer four-file set patching ssh, sshd, ssh-keygen and scp, and an older two-file ssh/sshd set) captured inbound/outbound credentials to encrypted stores (/usr/share/man9/ph/.ph.man with format [Direction][AuthType][Status]-user@IP:port->password; older variant /usr/lib/eth-scsi/libethscsi.so) and keylogged sessions (/usr/share/man9/ph/s[MD5(user+TTY)] for sshd, c[MD5(UID+SSH_TTY)] for ssh; older variant /var/lib/sam/sam_<timestamp>). A custom '-d' flag disabled credential and session logging for the operator's own sessions, scp's '!' flag masqueraded the process as '[kauditd] -sh', and scp could disable SELinux when run as root. Backdoor tokens in the older variant rotated across seven MD5 hashes by day-of-week. Files were timestomped to the creation time of /etc/shells. Attacker SSH public keys were appended to privileged accounts' authorized_keys for binary-independent re-entry. The earliest keylog artifacts trace to 2016. Velvet Ant's separately-reported 2024 activity (F5 BIG-IP appliance abuse and exploitation of Cisco NX-OS CVE-2024-20399) reflects the same playbook of weaponizing trusted, lightly-monitored infrastructure.
MITRE ATT&CK techniques used in TL-2026-0807
Credential Access
T1003 OS Credential Dumping; T1056.001 Keylogging; T1552.001 Credentials In Files
Collection
Lateral Movement
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1564.001 Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1572 Protocol Tunneling; T1573 Encrypted Channel
Persistence
T1098.004 SSH Authorized Keys; T1543.002 Systemd Service; T1554 Compromise Host Software Binary; T1556.003 Pluggable Authentication Modules
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
T1556 Modify Authentication Process; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in Velvet Ant (Operation Highland)
- Linux-PAM — pam_unix.so (Pluggable Authentication Modules)
Vulnerable versions: multiple distro builds, attacker-replaced
Fixed in: reinstall from trusted vendor package - OpenSSH / OpenBSD — OpenSSH (ssh, sshd, scp, ssh-keygen)
Vulnerable versions: multiple builds, attacker-replaced
Fixed in: reinstall from trusted vendor package - Cisco — NX-OS (Nexus switches)
Vulnerable versions: pre-July-2024 NX-OS
Fixed in: NX-OS patched July 2024 for CVE-2024-20399 - F5 — BIG-IP
Vulnerable versions: appliances repurposed as internal C2 (2024 activity)
Fixed in: per F5 hardening guidance
Remediation for Velvet Ant (Operation Highland)
Patches
- Apply Cisco fix for CVE-2024-20399 on Nexus / NX-OS devices (patched July 2024).
- Rebuild and reinstall PAM and OpenSSH from trusted vendor sources after lab validation across each affected distro.
Immediate actions
- Do NOT delete backdoored auth components first: restore trust before cutting access. Remove backdoors before any password reset, since the login layer harvests credentials during the reset itself.
- Hash-compare pam_unix.so, ssh, sshd, scp, sftp and ssh-keygen against known-good vendor packages for the exact distro/version; investigate any size/hash deviation.
- Hunt for hidden credential/keylog stores: /usr/share/man9/ph/, /var/lib/sam/, /usr/lib/eth-scsi/libethscsi.so, /usr/sbin/.ssh.log.
- Audit all authorized_keys files on privileged accounts and remove unrecognized public keys.
- Block and alert on outbound DNS/connections to gs.thc[.]org and its single-character subdomains.
Workarounds
- Validate replacement auth binaries in a lab across all affected Linux distributions before production rollout to avoid administrator lockout and outages.
- Monitor F5 BIG-IP and other edge appliances for unexpected outbound connections used as internal command bridges.
Longer-term hardening
- Shift from signature-based detection to behavioral anomaly detection on the authentication layer.
- Deploy File Integrity Monitoring on /etc/pam.d/, PAM/OpenSSH binaries, /lib/systemd/system/, /etc/init.d/, /etc/ld.so.conf.d/ and sshd_config.
- Establish package-verification baselines (rpm -V / debsums) and continuous drift detection on auth binaries.
- Proactive threat hunting across segregated/air-gapped segments; do not assume isolation prevents persistence.
Weaknesses (CWE) in Velvet Ant (Operation Highland)
CWE-78
Timeline of Velvet Ant (Operation Highland)
- Earliest forensic keylog artifacts from the older OpenSSH backdoor variant trace to 2016, marking the start of Velvet Ant's undetected presence.
- Velvet Ant established an internet-facing foothold using a modified GS-Netcat ('auditdb') reverse shell and a Perl ssspl-based SOCKS5 proxy.
- Backdoored pam_unix.so variants and modified OpenSSH binaries deployed to subvert the authentication layer with credential harvesting and keylogging.
- Actor pivoted via an Nginx/FastCGI HTTP-POST SSH-tunnel binary ('uptime') into a segregated critical-infrastructure network with no direct internet access.
- Velvet Ant's separately-reported 2024 activity included exploitation of Cisco NX-OS CVE-2024-20399 (patched July 2024) and abuse of F5 BIG-IP appliances as internal command bridges.
- Sygnia's forensic investigation (Operation Highland) uncovered the nine pam_unix.so variants and the multi-layer authentication backdoor.
- Initial media reporting (The Hacker News) disclosed the China-linked backdooring of Linux login software.
- Sygnia published the full Operation Highland technical analysis attributing the campaign to Velvet Ant (G1047).
Sources cited for Velvet Ant (Operation Highland)
- Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected
- Velvet Ant backdoored authentication for long-term persistence
- China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
- Chinese hackers hijack auth flow, spy on isolated network for a decade
- Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network
- China-nexus group hid in Linux login system for nearly a decade
- MITRE ATT&CK Group: Velvet Ant (G1047)
- NVD - CVE-2024-20399 (Cisco NX-OS command injection)
Threats related to Velvet Ant (Operation Highland)
- Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network
- RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update
Detection coverage for TL-2026-0807
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0807 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.