# Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence

> China-nexus espionage actor Velvet Ant (G1047) maintained nearly ten years of undetected access to a segregated critical-infrastructure network by backdooring the Linux authentication layer rather than dropping conventional malware. Sygnia's investigation, dubbed Operation Highland, found nine separately-compiled pam_unix.so variants enabling password bypass and credential harvesting, modified OpenSSH binaries that captured credentials and keylogged sessions into encrypted hidden files, a modified GS-Netcat reverse shell, a Perl ssspl-based SOCKS5 proxy, an HTTP-POST-driven SSH tunneling binary fronted by Nginx/FastCGI, and authorized_keys injection.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0807
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-velvet-ant-highland-pam-backdoor-tl-2026-0807.webp?v=c165ead2 (Threadlinqs threat intel: Velvet Ant Highland PAM Backdoor: Detection & IOCs (TL-2026-0807) — Critical severity, 28 IOCs, 9 detection rules.)
- **ID:** TL-2026-0807
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Velvet Ant (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (1 shown free below)
- **CVEs:** CVE-2024-20399

## Description

Sygnia disclosed Operation Highland on 2026-06-15, attributing it to the China-nexus group Velvet Ant (MITRE G1047), an actor known for stealthy multi-year persistence. The campaign is notable because it contained no novel exploit and no obviously malicious dropper: the adversary subverted the components that perform authentication itself, so password resets and session terminations were ineffective because the very code validating credentials was working for the attacker.

Stage 1 (internet-facing foothold): Velvet Ant deployed a modified GS-Netcat utility as a binary named 'auditdb' in /usr/sbin/, masquerading via argv[0] as the kernel thread '[khubd]' and beaconing encrypted reverse shells to single-character subdomains of gs.thc[.]org. Persistence was established through a malicious systemd unit in /lib/systemd/system/ disguised as a Chrome service and via injection into /etc/init.d/ SysVinit scripts. A custom Perl SOCKS5 proxy derived from the public 'ssspl' project (process name 'smbd -D', unique port/filename per sample) provided bidirectional tunneling.

Stage 2 (pivot to isolated IT network): Internet-facing Nginx proxied requests to a backend Nginx instance forwarding to a local FastCGI process (fcgiwrap), which executed a custom SSH-tunnel binary named 'uptime' that accepted HTTP POST parameters and opened SSH connections into the air-gapped critical-infrastructure segment, executing remote scripts to retrieve confidential data without any direct external connectivity.

Stage 3 (authentication-layer compromise): Nine distinct backdoored pam_unix.so variants were identified, each compiled in a separate environment (distinguished by unique RPATH strings such as /home/kevin/Desktop/Linux-PAM-<ver>/libpam/.libs:/lib64 and /c/src/Linux-PAM-<ver>/libpam/.libs). Variants either accepted a hardcoded backdoor password (verified inside pam_sm_authenticate then NULL-overwritten, producing no logs) or harvested every credential to /usr/sbin/.ssh.log in [username]:[password] form, using an encrypted constant 'Pamauth@123456'. Modified OpenSSH binaries (a newer four-file set patching ssh, sshd, ssh-keygen and scp, and an older two-file ssh/sshd set) captured inbound/outbound credentials to encrypted stores (/usr/share/man9/ph/.ph.man with format [Direction][AuthType][Status]-user@IP:port->password; older variant /usr/lib/eth-scsi/libethscsi.so) and keylogged sessions (/usr/share/man9/ph/s[MD5(user+TTY)] for sshd, c[MD5(UID+SSH_TTY)] for ssh; older variant /var/lib/sam/sam_<timestamp>). A custom '-d' flag disabled credential and session logging for the operator's own sessions, scp's '!' flag masqueraded the process as '[kauditd] -sh', and scp could disable SELinux when run as root. Backdoor tokens in the older variant rotated across seven MD5 hashes by day-of-week. Files were timestomped to the creation time of /etc/shells. Attacker SSH public keys were appended to privileged accounts' authorized_keys for binary-independent re-entry. The earliest keylog artifacts trace to 2016. Velvet Ant's separately-reported 2024 activity (F5 BIG-IP appliance abuse and exploitation of Cisco NX-OS CVE-2024-20399) reflects the same playbook of weaponizing trusted, lightly-monitored infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1543.002 Systemd Service
- T1556.003 Pluggable Authentication Modules
- T1098.004 SSH Authorized Keys
- T1554 Compromise Host Software Binary
- T1068 Exploitation for Privilege Escalation
- T1036.005 Match Legitimate Resource Name or Location
- T1070.006 Timestomp
- T1685.006 Clear Linux or Mac System Logs
- T1685 Disable or Modify Tools
- T1564.001 Hidden Files and Directories
- T1556 Modify Authentication Process
- T1056.001 Keylogging
- T1003 OS Credential Dumping
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1071.001 Web Protocols
- T1090 Proxy
- T1573 Encrypted Channel
- T1021.004 SSH
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Velvet Ant Auth-Layer Tamper — PAM/OpenSSH Binary Drift & Hidden Credential Stores (Post-Exploitation)** (`TL-2026-0807-SPL-002`)

Detects the Stage-3 authentication-layer compromise: package-verification drift on pam_unix.so / ssh / sshd / scp / ssh-keygen (rpm -V / debsums mismatch), and the creation or presence of the hidden credential and keylog stores the backdoors write — /usr/sbin/.ssh.log, /usr/share/man9/ph/, /usr/lib/eth-scsi/libethscsi.so, and /var/lib/sam/. These paths are not part of any legitimate package and writes to auth binaries' directories outside a package transaction indicate tampering.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1556.003, T1554, T1552.001, T1564.001
- **Data sources:** file_integrity_monitoring, auditd, package_verification, edr_file_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux_fim sourcetype="linux:fim" (object_path IN ("/usr/lib*/security/pam_unix.so","/usr/bin/ssh","/usr/sbin/sshd","/usr/bin/scp","/usr/bin/ssh-keygen") OR object_path IN ("/usr/sbin/.ssh.log","/usr/lib/eth-scsi/libethscsi.so") OR like(object_path,"/usr/share/man9/ph/%") OR like(object_path,"/var/lib/sam/sam_%"))
| eval verify_fail=if(match(pkg_verify_status,"(?i)mismatch|fail|altered|5"),1,0)
| eval hidden_store=if(like(object_path,"%/.ssh.log") OR like(object_path,"/usr/share/man9/ph/%") OR like(object_path,"/var/lib/sam/sam_%") OR like(object_path,"%/libethscsi.so"),1,0)
| where verify_fail=1 OR hidden_store=1
| stats count min(_time) as firstSeen max(_time) as lastSeen values(action) as actions values(object_path) as paths by host, user
| eval reason="auth_binary_drift_or_hidden_credstore"
| convert ctime(firstSeen) ctime(lastSeen)
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("/usr/share/man9/ph", "/var/lib/sam", "/usr/lib/eth-scsi/libethscsi.so")
    or FileName == ".ssh.log"
    or (FolderPath has_any ("/security/pam_unix.so","/usr/bin/ssh","/usr/sbin/sshd","/usr/bin/scp","/usr/bin/ssh-keygen")
        and ActionType in ("FileModified","FileCreated","FileRenamed")
        and InitiatingProcessFileName !in ("rpm","dpkg","apt","yum","dnf","zypper","unattended-upgrade"))
| project Timestamp, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc
```

### Sigma

```yaml
title: Velvet Ant PAM/OpenSSH Backdoor - Binary Drift and Hidden Credential Stores
id: 5b2e9a14-0807-4c02-9a22-pamhidden0002
status: experimental
description: Detects tampering of PAM/OpenSSH auth binaries outside package management and creation of the hidden credential/keylog stores used by Operation Highland (Velvet Ant).
references:
  - https://www.sygnia.co/blog/operation-highland-velvet-ant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
  - attack.persistence
  - attack.t1556.003
  - attack.t1554
  - attack.credential_access
  - attack.t1552.001
  - attack.defense_evasion
  - attack.t1564.001
logsource:
  product: linux
  category: file_event
detection:
  selection_store:
    TargetFilename|contains:
      - '/usr/share/man9/ph/'
      - '/var/lib/sam/sam_'
      - '/usr/lib/eth-scsi/libethscsi.so'
      - '/usr/sbin/.ssh.log'
  selection_authbin:
    TargetFilename|contains:
      - '/security/pam_unix.so'
      - '/usr/bin/ssh'
      - '/usr/sbin/sshd'
      - '/usr/bin/scp'
      - '/usr/bin/ssh-keygen'
  filter_pkgmgr:
    Image|endswith:
      - '/rpm'
      - '/dpkg'
      - '/apt'
      - '/yum'
      - '/dnf'
      - '/zypper'
  condition: selection_store or (selection_authbin and not filter_pkgmgr)
falsepositives:
  - Vendor patch installs via package manager (excluded by filter_pkgmgr)
  - Source-built OpenSSH/PAM during sanctioned maintenance windows
level: critical
```

**Known false positives:**

- Legitimate PAM/OpenSSH upgrades through rpm/dpkg/apt (excluded via package-manager filter)
- Admin-built auth binaries during approved maintenance — correlate with change tickets

**Tuning notes:** Seed FIM with known-good vendor hashes for the exact distro/version of each auth binary; any size/hash deviation is the primary signal. The hidden-store paths (/usr/share/man9/ph/, /var/lib/sam/, libethscsi.so, .ssh.log) have zero legitimate use — alert at critical with no suppression. Run rpm -V / debsums on a schedule and feed results into index=linux_fim.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Velvet Ant Systemd/SysVinit Persistence — Disguised Chrome Service (Exploitation/Persistence) (locked: unlock with TL Creds)
- Velvet Ant Credential Harvest & Authorized-Keys Injection (Post-Exploitation) (locked: unlock with TL Creds)
- Velvet Ant Defense Evasion — Timestomp to /etc/shells & SELinux Disable via scp Backdoor (C2/Defense Evasion) (locked: unlock with TL Creds)
- Velvet Ant Initial Access — Internet-Facing Web Tier Spawning Reverse Shell (Exploitation) (locked: unlock with TL Creds)
- Velvet Ant PAM Backdoor Auth Anomaly — Successful Login With No Corresponding pam_unix Audit (Post-Exploitation) (locked: unlock with TL Creds)
- Velvet Ant Covert SSH Pivot to Segregated Network — FastCGI-Driven Outbound SSH (C2/Lateral Movement) (locked: unlock with TL Creds)
- Velvet Ant GS-Netcat Foothold — [indicator] Binary & Kernel-Thread Masquerade (Exploitation) (locked: unlock with TL Creds)
- Velvet Ant C2 & Covert Tunneling — [indicator] Beacon, SOCKS5 Proxy & FastCGI SSH Pivot (C2/Lateral) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 28)

Defanged, TLP:CLEAR.

- Domain: `gs[.]thc[.]org`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected](https://www.sygnia.co/blog/operation-highland-velvet-ant/)
- [Velvet Ant backdoored authentication for long-term persistence](https://www.helpnetsecurity.com/2026/06/15/velvet-ant-backdoored-authentication-persistence/)
- [China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade](https://thehackernews.com/2026/06/china-linked-hackers-backdoored-linux.html)
- [Chinese hackers hijack auth flow, spy on isolated network for a decade](https://www.bleepingcomputer.com/news/security/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade/)
- [Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network](https://gbhackers.com/velvet-ant-hackers-backdoor-openssh/)
- [China-nexus group hid in Linux login system for nearly a decade](https://www.scworld.com/brief/china-nexus-group-hid-in-linux-login-system-for-nearly-a-decade)
- [MITRE ATT&CK Group: Velvet Ant (G1047)](https://attack.mitre.org/groups/G1047/)
- [NVD - CVE-2024-20399 (Cisco NX-OS command injection)](https://nvd.nist.gov/vuln/detail/CVE-2024-20399)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0807