Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network
Velvet Ant (China-Nexus) 'Operation Highland' (TL-2026-0809), also tracked as Operation Highland, is a high-severity malware campaign, first published 2026-06-15. It is attributed to Velvet Ant (China) with high confidence, affects Linux-PAM pam_unix.so (PAM authentication module), maps to 28 MITRE ATT&CK techniques (T1003, T1021.004, T1027), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0809
- Threat ID
- TL-2026-0809
- Also known as
- Operation Highland
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-15
- Last reviewed
- 2026-06-15
- Attribution
- Velvet Ant
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- critical infrastructure, government
- Target regions
- East Asia
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in Velvet Ant (China-Nexus) 'Operation Highland'
Malware and tooling: Custom Perl SOCKS5 proxy, Netcat
Sygnia uncovered Operation Highland, a near-decade-long (since ~2016) espionage intrusion by the China-nexus actor Velvet Ant that backdoored the Linux authentication stack — nine distinct pam_unix.so variants and trojanized OpenSSH binaries — to accept a hardcoded password, harvest credentials, and suppress its own logging while operating undetected inside an isolated critical-infrastructure network. Lateral access was maintained via a modified GS-Netcat reverse shell masquerading as auditd ([kauditd]) and a Perl SOCKS5 proxy masquerading as smbd -D, with HTTP relaying through a compromised Nginx server to reach the internet-disconnected segment.
How Velvet Ant (China-Nexus) 'Operation Highland' works
Operation Highland is a China-nexus cyber-espionage intrusion documented by incident-response firm Sygnia in June 2026 and attributed to Velvet Ant, a state-sponsored threat actor previously tracked weaponizing legacy F5 BIG-IP appliances (PlugX/VELVETSTING/VELVETTAP internal C2) and exploiting CVE-2024-20399 in Cisco NX-OS to deploy the VELVETSHELL backdoor. In this campaign the actor compromised a major organization and persisted for nearly a decade — forensic artifacts and the oldest keylogging activity trace back to 2016 — by subverting the core Linux authentication stack rather than relying on conventional implants.
The centerpiece is a set of nine backdoored pam_unix.so PAM modules. The attackers patched the pam_sm_authenticate function so it would either accept a hardcoded backdoor password (Pamauth@123456), silently harvest credentials from legitimate authentication attempts, or both. After a successful backdoor authentication the module overwrote the backdoor password string in memory with NULL bytes to frustrate memory-forensic recovery. A custom embedded flag disabled the attacker's own credential and session logging so their activity left no recorded evidence. The trojanized modules were identifiable by anomalous RPATH strings betraying the build environment, including paths such as /home/kevin/Desktop/Linux-PAM-{version}/libpam/.libs:/lib64 and /c/src/Linux-PAM-{version}/libpam/.libs.
Alongside PAM, Velvet Ant trojanized OpenSSH components. Newer variants modified ssh, sshd, ssh-keygen, and scp; older variants modified ssh and sshd. A '-d' runtime flag disabled credential logging and keylogging, and a '!' flag hid the scp process. Harvested credentials were written to log files such as /usr/sbin/.ssh.log and an encrypted credential dump at /usr/share/man9/ph/.ph.man (keylogging directory /usr/share/man9/ph/), with older variants storing data under /var/lib/sam/ and /usr/lib/eth-scsi/libethscsi.so. The credential log format encoded direction, authentication type (B=Kerberos, C=PAM, X=SSH2), and status as [Direction][AuthType][Status]-user@IP:port->password.
For remote access, a modified GS-Netcat reverse shell was deployed as /usr/sbin/auditd (also observed as auditdb) and overwrote its own process name to masquerade as the legitimate kernel thread [kauditd] (also khubd), connecting to a relay matching the THC GS-Netcat pattern %.gs.thc.org. A custom Perl SOCKS5 proxy ran as a daemon masquerading as smbd -D, using different filenames and ports on each host to tunnel traffic into systems not directly reachable from the internet. A custom binary named 'uptime' acted as a FastCGI execution bridge, and the actor reconfigured a compromised internet-facing Nginx server to proxy specially crafted HTTP requests to a compromised backend, enabling command execution into the otherwise air-gapped network. Persistence used systemd unit files in /lib/systemd/system/ (one disguised as a Chrome service) on newer servers, appended execution lines in /etc/init.d/ SysVinit scripts on older servers, and injection of attacker SSH public keys into authorized_keys for password-less access.
Remediation was operationally hazardous: removing the backdoored authentication components risked breaking authentication, locking out legitimate administrators, and causing outages, so Sygnia built test labs and validation procedures and advised rotating credentials only after persistence was fully removed. No CVE is associated with this intrusion — it relies on trojanizing legitimate authentication software, not exploiting a specific vulnerability.
MITRE ATT&CK techniques used in TL-2026-0809
Credential Access
T1003 OS Credential Dumping; T1056.001 Keylogging; T1110.001 Password Guessing; T1556 Modify Authentication Process
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036.004 Masquerade Task or Service; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp
Persistence
T1037.004 RC Scripts; T1098.004 SSH Authorized Keys; T1543.002 Systemd Service; T1554 Compromise Host Software Binary; T1556.003 Pluggable Authentication Modules
credential-access
Execution
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573 Encrypted Channel
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
defense-impairment
T1556.003 Pluggable Authentication Modules; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
stealth
Affected products and versions in Velvet Ant (China-Nexus) 'Operation Highland'
- Linux-PAM — pam_unix.so (PAM authentication module)
Vulnerable versions: trojanized builds replacing legitimate module
Fixed in: reinstall verified vendor package - OpenSSH — OpenSSH (ssh, sshd, ssh-keygen, scp binaries)
Vulnerable versions: trojanized binaries replacing legitimate builds
Fixed in: reinstall verified vendor package - Generic — Linux servers (systemd and SysVinit based)
Vulnerable versions: newer servers (systemd); older servers (SysVinit)
Remediation for Velvet Ant (China-Nexus) 'Operation Highland'
Immediate actions
- Hunt for backdoored pam_unix.so modules: verify package integrity (rpm -V / debsums) and inspect RPATH strings (e.g. readelf -d) for anomalies such as '/home/kevin/Desktop/Linux-PAM-*/libpam/.libs:/lib64' or '/c/src/Linux-PAM-*/libpam/.libs'
- Search for the GS-Netcat implant at /usr/sbin/auditd and /usr/sbin/auditdb and for processes spoofing the [kauditd]/khubd kernel-thread names
- Block outbound connections to the GS-Netcat relay pattern *.gs.thc.org at the perimeter
- Audit /lib/systemd/system/ and /etc/init.d/ for unauthorized units/scripts (including any disguised as a Chrome service) and inspect all authorized_keys files for unrecognized public keys
- Verify integrity of OpenSSH binaries (ssh, sshd, ssh-keygen, scp) against trusted package hashes
- Look for SOCKS5 proxy daemons masquerading as 'smbd -D' on non-standard ports and a FastCGI bridge binary named 'uptime'
Workarounds
- Where backdoored authentication components are found, build a test/validation lab and stage rollback options before remediation to avoid lockout and outages
- Rotate all credentials only after attacker persistence is fully removed
Longer-term hardening
- Treat PAM, OpenSSH, LSASS, and all privileged authentication paths as critical security controls with file-integrity monitoring and signed-package enforcement
- Deploy EDR on all supported systems, including legacy and isolated hosts
- Enable high-confidence alerts for modification of authentication and system files
- Segment and monitor internet-facing relay points (e.g. Nginx) that border isolated networks
Weaknesses (CWE) in Velvet Ant (China-Nexus) 'Operation Highland'
CWE-798, CWE-506, CWE-300, CWE-1395
Timeline of Velvet Ant (China-Nexus) 'Operation Highland'
- Earliest forensic artifacts and oldest keylogging activity place Velvet Ant's presence in the environment at 2016, beginning a near-decade-long undetected intrusion (Sygnia).
- Backdoored authentication-stack persistence (pam_unix.so and trojanized OpenSSH) established across compromised hosts, enabling credential theft and hardcoded-password backdoor access into the isolated network.
- Sygnia publicly documents prior Velvet Ant activity abusing legacy F5 BIG-IP appliances as internal C2 (PlugX, VELVETSTING, VELVETTAP), establishing the actor's profile and attribution.
- Velvet Ant linked to exploitation of CVE-2024-20399 (Cisco NX-OS) to deploy the VELVETSHELL backdoor on Cisco Nexus switches — context for the actor's network-device tradecraft.
- Sygnia publishes the technical 'Operation Highland' report detailing the backdoored pam_unix.so modules, trojanized OpenSSH suite, GS-Netcat implant, and Nginx/FastCGI relay used to reach the isolated network.
- Initial reporting circulates describing a China-nexus actor hiding in a Linux login system for nearly a decade.
- Sygnia issues remediation guidance: treat PAM/OpenSSH/privileged paths as critical controls, build validation labs before removing backdoored auth components, and rotate credentials only after persistence is fully removed.
- Mainstream security press (Cyber Security News, BleepingComputer, Help Net Security, GBHackers, SC World) covers the Operation Highland backdoored PAM/OpenSSH credential-theft campaign.
Sources cited for Velvet Ant (China-Nexus) 'Operation Highland'
- Velvet Ant's Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected
- China-Nexus Hackers Use Backdoored PAM Modules for Credential Theft and Authentication Bypass
- Chinese hackers hijack auth flow, spy on isolated network for a decade
- China-linked spies backdoored authentication stack to stay hidden for years
- Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network
- China-nexus group hid in Linux login system for nearly a decade
- China-Nexus Threat Group 'Velvet Ant' Abuses F5 Load Balancers (prior campaign / attribution context)
- Hackers use F5 BIG-IP malware to stealthily steal data for years (Velvet Ant prior activity)
Threats related to Velvet Ant (China-Nexus) 'Operation Highland'
- Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence
- RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update
- PamDOORa: Commercialized PAM-Abuse Backdoor for SSH Credential Theft on Linux — Evolution of the Plague / pam_exec Technique Lineage
Detection coverage for TL-2026-0809
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0809 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.