Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence

Key facts for Velvet Ant Highland PAM backdoor

Detection coverage for Velvet Ant Highland PAM backdoor

As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0807 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Velvet Ant Auth-Layer Tamper — PAM/OpenSSH Binary Drift & Hidden Credential Stores (Post-Exploitation)

Detects the Stage-3 authentication-layer compromise: package-verification drift on pam_unix.so / ssh / sshd / scp / ssh-keygen (rpm -V / debsums mismatch), and the creation or presence of the hidden credential and keylog stores the backdoors write — /usr/sbin/.ssh.log, /usr/share/man9/ph/, /usr/lib/eth-scsi/libethscsi.so, and /var/lib/sam/. These paths are not part of any legitimate package and writes to auth binaries' directories outside a package transaction indicate tampering.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1556.003, T1554, T1552.001, T1564.001
• Data sources: file_integrity_monitoring, auditd, package_verification, edr_file_events
• Severity: critical
• Confidence: high

Splunk SPL

index=linux_fim sourcetype="linux:fim" (object_path IN ("/usr/lib*/security/pam_unix.so","/usr/bin/ssh","/usr/sbin/sshd","/usr/bin/scp","/usr/bin/ssh-keygen") OR object_path IN ("/usr/sbin/.ssh.log","/usr/lib/eth-scsi/libethscsi.so") OR like(object_path,"/usr/share/man9/ph/%") OR like(object_path,"/var/lib/sam/sam_%"))
| eval verify_fail=if(match(pkg_verify_status,"(?i)mismatch|fail|altered|5"),1,0)
| eval hidden_store=if(like(object_path,"%/.ssh.log") OR like(object_path,"/usr/share/man9/ph/%") OR like(object_path,"/var/lib/sam/sam_%") OR like(object_path,"%/libethscsi.so"),1,0)
| where verify_fail=1 OR hidden_store=1
| stats count min(_time) as firstSeen max(_time) as lastSeen values(action) as actions values(object_path) as paths by host, user
| eval reason="auth_binary_drift_or_hidden_credstore"
| convert ctime(firstSeen) ctime(lastSeen)

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("/usr/share/man9/ph", "/var/lib/sam", "/usr/lib/eth-scsi/libethscsi.so")
    or FileName == ".ssh.log"
    or (FolderPath has_any ("/security/pam_unix.so","/usr/bin/ssh","/usr/sbin/sshd","/usr/bin/scp","/usr/bin/ssh-keygen")
        and ActionType in ("FileModified","FileCreated","FileRenamed")
        and InitiatingProcessFileName !in ("rpm","dpkg","apt","yum","dnf","zypper","unattended-upgrade"))
| project Timestamp, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

Sigma

title: Velvet Ant PAM/OpenSSH Backdoor - Binary Drift and Hidden Credential Stores
id: 5b2e9a14-0807-4c02-9a22-pamhidden0002
status: experimental
description: Detects tampering of PAM/OpenSSH auth binaries outside package management and creation of the hidden credential/keylog stores used by Operation Highland (Velvet Ant).
references:
  - https://www.sygnia.co/blog/operation-highland-velvet-ant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
  - attack.persistence
  - attack.t1556.003
  - attack.t1554
  - attack.credential_access
  - attack.t1552.001
  - attack.defense_evasion
  - attack.t1564.001
logsource:
  product: linux
  category: file_event
detection:
  selection_store:
    TargetFilename|contains:
      - '/usr/share/man9/ph/'
      - '/var/lib/sam/sam_'
      - '/usr/lib/eth-scsi/libethscsi.so'
      - '/usr/sbin/.ssh.log'
  selection_authbin:
    TargetFilename|contains:
      - '/security/pam_unix.so'
      - '/usr/bin/ssh'
      - '/usr/sbin/sshd'
      - '/usr/bin/scp'
      - '/usr/bin/ssh-keygen'
  filter_pkgmgr:
    Image|endswith:
      - '/rpm'
      - '/dpkg'
      - '/apt'
      - '/yum'
      - '/dnf'
      - '/zypper'
  condition: selection_store or (selection_authbin and not filter_pkgmgr)
falsepositives:
  - Vendor patch installs via package manager (excluded by filter_pkgmgr)
  - Source-built OpenSSH/PAM during sanctioned maintenance windows
level: critical

Known false positives:

• Legitimate PAM/OpenSSH upgrades through rpm/dpkg/apt (excluded via package-manager filter)
• Admin-built auth binaries during approved maintenance — correlate with change tickets

Tuning notes: Seed FIM with known-good vendor hashes for the exact distro/version of each auth binary; any size/hash deviation is the primary signal. The hidden-store paths (/usr/share/man9/ph/, /var/lib/sam/, libethscsi.so, .ssh.log) have zero legitimate use — alert at critical with no suppression. Run rpm -V / debsums on a schedule and feed results into index=linux_fim.

• 🔒 Velvet Ant Systemd/SysVinit Persistence — Disguised Chrome Service (Exploitation/Persistence) · unlock with TL Creds
• 🔒 Velvet Ant Credential Harvest & Authorized-Keys Injection (Post-Exploitation) · unlock with TL Creds
• 🔒 Velvet Ant Defense Evasion — Timestomp to /etc/shells & SELinux Disable via scp Backdoor (C2/Defense Evasion) · unlock with TL Creds
• 🔒 Velvet Ant Initial Access — Internet-Facing Web Tier Spawning Reverse Shell (Exploitation) · unlock with TL Creds
• 🔒 Velvet Ant PAM Backdoor Auth Anomaly — Successful Login With No Corresponding pam_unix Audit (Post-Exploitation) · unlock with TL Creds
• 🔒 Velvet Ant Covert SSH Pivot to Segregated Network — FastCGI-Driven Outbound SSH (C2/Lateral Movement) · unlock with TL Creds
• 🔒 Velvet Ant GS-Netcat Foothold — [indicator] Binary & Kernel-Thread Masquerade (Exploitation) · unlock with TL Creds
• 🔒 Velvet Ant C2 & Covert Tunneling — [indicator] Beacon, SOCKS5 Proxy & FastCGI SSH Pivot (C2/Lateral) · unlock with TL Creds

Indicators of compromise for Velvet Ant Highland PAM backdoor

As of 2026-06-15, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-0807.

Sample indicators (1 of 28)

• Domain: gs[.]thc[.]org

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

How Velvet Ant Highland PAM backdoor works

Sygnia disclosed Operation Highland on 2026-06-15, attributing it to the China-nexus group Velvet Ant (MITRE G1047), an actor known for stealthy multi-year persistence. The campaign is notable because it contained no novel exploit and no obviously malicious dropper: the adversary subverted the components that perform authentication itself, so password resets and session terminations were ineffective because the very code validating credentials was working for the attacker.

Stage 1 (internet-facing foothold): Velvet Ant deployed a modified GS-Netcat utility as a binary named 'auditdb' in /usr/sbin/, masquerading via argv[0] as the kernel thread '[khubd]' and beaconing encrypted reverse shells to single-character subdomains of gs.thc[.]org. Persistence was established through a malicious systemd unit in /lib/systemd/system/ disguised as a Chrome service and via injection into /etc/init.d/ SysVinit scripts. A custom Perl SOCKS5 proxy derived from the public 'ssspl' project (process name 'smbd -D', unique port/filename per sample) provided bidirectional tunneling.

Stage 2 (pivot to isolated IT network): Internet-facing Nginx proxied requests to a backend Nginx instance forwarding to a local FastCGI process (fcgiwrap), which executed a custom SSH-tunnel binary named 'uptime' that accepted HTTP POST parameters and opened SSH connections into the air-gapped critical-infrastructure segment, executing remote scripts to retrieve confidential data without any direct external connectivity.

Stage 3 (authentication-layer compromise): Nine distinct backdoored pam_unix.so variants were identified, each compiled in a separate environment (distinguished by unique RPATH strings such as /home/kevin/Desktop/Linux-PAM-<ver>/libpam/.libs:/lib64 and /c/src/Linux-PAM-<ver>/libpam/.libs). Variants either accepted a hardcoded backdoor password (verified inside pam_sm_authenticate then NULL-overwritten, producing no logs) or harvested every credential to /usr/sbin/.ssh.log in [username]:[password] form, using an encrypted constant 'Pamauth@123456'. Modified OpenSSH binaries (a newer four-file set patching ssh, sshd, ssh-keygen and scp, and an older two-file ssh/sshd set) captured inbound/outbound credentials to encrypted stores (/usr/share/man9/ph/.ph.man with format [Direction][AuthType][Status]-user@IP:port->password; older variant /usr/lib/eth-scsi/libethscsi.so) and keylogged sessions (/usr/share/man9/ph/s[MD5(user+TTY)] for sshd, c[MD5(UID+SSH_TTY)] for ssh; older variant /var/lib/sam/sam_<timestamp>). A custom '-d' flag disabled credential and session logging for the operator's own sessions, scp's '!' flag masqueraded the process as '[kauditd] -sh', and scp could disable SELinux when run as root. Backdoor tokens in the older variant rotated across seven MD5 hashes by day-of-week. Files were timestomped to the creation time of /etc/shells. Attacker SSH public keys were appended to privileged accounts' authorized_keys for binary-independent re-entry. The earliest keylog artifacts trace to 2016. Velvet Ant's separately-reported 2024 activity (F5 BIG-IP appliance abuse and exploitation of Cisco NX-OS CVE-2024-20399) reflects the same playbook of weaponizing trusted, lightly-monitored infrastructure.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1056.001 Keylogging; T1552.001 Credentials In Files

Collection

T1005 Data from Local System

Lateral Movement

T1021.004 SSH

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1572 Protocol Tunneling; T1573 Encrypted Channel

Persistence

T1098.004 SSH Authorized Keys; T1543.002 Systemd Service; T1554 Compromise Host Software Binary; T1556.003 Pluggable Authentication Modules

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1556 Modify Authentication Process; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs

Remediation for Velvet Ant Highland PAM backdoor

Patches

• Apply Cisco fix for CVE-2024-20399 on Nexus / NX-OS devices (patched July 2024).
• Rebuild and reinstall PAM and OpenSSH from trusted vendor sources after lab validation across each affected distro.

Immediate actions

• Do NOT delete backdoored auth components first: restore trust before cutting access. Remove backdoors before any password reset, since the login layer harvests credentials during the reset itself.
• Hash-compare pam_unix.so, ssh, sshd, scp, sftp and ssh-keygen against known-good vendor packages for the exact distro/version; investigate any size/hash deviation.
• Hunt for hidden credential/keylog stores: /usr/share/man9/ph/, /var/lib/sam/, /usr/lib/eth-scsi/libethscsi.so, /usr/sbin/.ssh.log.
• Audit all authorized_keys files on privileged accounts and remove unrecognized public keys.
• Block and alert on outbound DNS/connections to gs.thc[.]org and its single-character subdomains.

Workarounds

• Validate replacement auth binaries in a lab across all affected Linux distributions before production rollout to avoid administrator lockout and outages.
• Monitor F5 BIG-IP and other edge appliances for unexpected outbound connections used as internal command bridges.

Longer-term hardening

• Shift from signature-based detection to behavioral anomaly detection on the authentication layer.
• Deploy File Integrity Monitoring on /etc/pam.d/, PAM/OpenSSH binaries, /lib/systemd/system/, /etc/init.d/, /etc/ld.so.conf.d/ and sshd_config.
• Establish package-verification baselines (rpm -V / debsums) and continuous drift detection on auth binaries.
• Proactive threat hunting across segregated/air-gapped segments; do not assume isolation prevents persistence.

Affected and fixed versions

• Linux-PAM — pam_unix.so (Pluggable Authentication Modules)
  Vulnerable versions: multiple distro builds, attacker-replaced
  Fixed in: reinstall from trusted vendor package
• OpenSSH / OpenBSD — OpenSSH (ssh, sshd, scp, ssh-keygen)
  Vulnerable versions: multiple builds, attacker-replaced
  Fixed in: reinstall from trusted vendor package
• Cisco — NX-OS (Nexus switches)
  Vulnerable versions: pre-July-2024 NX-OS
  Fixed in: NX-OS patched July 2024 for CVE-2024-20399
• F5 — BIG-IP
  Vulnerable versions: appliances repurposed as internal C2 (2024 activity)
  Fixed in: per F5 hardening guidance

Timeline of Velvet Ant Highland PAM backdoor

• 2016-01-01 Earliest forensic keylog artifacts from the older OpenSSH backdoor variant trace to 2016, marking the start of Velvet Ant's undetected presence.
• 2016-06-01 Velvet Ant established an internet-facing foothold using a modified GS-Netcat ('locked-ioc-22') reverse shell and a Perl ssspl-based SOCKS5 proxy.
• 2018-01-01 Backdoored locked-ioc-20 variants and modified OpenSSH binaries deployed to subvert the authentication layer with credential harvesting and keylogging.
• 2020-01-01 Actor pivoted via an Nginx/FastCGI HTTP-POST SSH-tunnel binary ('locked-ioc-25') into a segregated critical-infrastructure network with no direct internet access.
• 2024-07-01 Velvet Ant's separately-reported 2024 activity included exploitation of Cisco NX-OS CVE-2024-20399 (patched July 2024) and abuse of F5 BIG-IP appliances as internal command bridges.
• 2026-05-01 Sygnia's forensic investigation (Operation Highland) uncovered the nine locked-ioc-20 variants and the multi-layer authentication backdoor.
• 2026-06-12 Initial media reporting (The Hacker News) disclosed the China-linked backdooring of Linux login software.
• 2026-06-15 Sygnia published the full Operation Highland technical analysis attributing the campaign to locked-ioc-15.

Sources cited for Velvet Ant Highland PAM backdoor

• NVD - CVE-2024-20399 (Cisco NX-OS command injection) NVD (NIST) · Advisory · 2024-07-01
• Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected sygnia.co · Vendor report · 2026-06-15
• MITRE ATT&CK Group: Velvet Ant (G1047) MITRE · Research · 2026-06-15
• Velvet Ant backdoored authentication for long-term persistence Help Net Security · News · 2026-06-15
• China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade The Hacker News · News · 2026-06-12
• Chinese hackers hijack auth flow, spy on isolated network for a decade BleepingComputer · News · 2026-06-13
• Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network gbhackers.com · News · 2026-06-13
• China-nexus group hid in Linux login system for nearly a decade scworld.com · News · 2026-06-13

Threats related to Velvet Ant Highland PAM backdoor

• Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network
• RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update

Related coverage of this activity

• Zimbra SNMP command injection RCE
• APT37 Ted & CurlRAT

More from Velvet Ant

• ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise

Previous and next in malware

• Malware Distribution Platform Exposed via Unsecured /install/install.php Setup Page (micronsoftwares[.]com / wetransfer[.]ICU SEO-Poisoning Operation) Previous report