Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network

Key facts for Velvet Ant OpenSSH kauditd shell

Detection coverage for Velvet Ant OpenSSH kauditd shell

As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0809 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GS-Netcat C2 Egress to *.gs.thc.org & Nginx/FastCGI Air-Gap Relay (C2 / Lateral Movement)

Detects Velvet Ant's encrypted GS-Netcat reverse-shell C2 and the Nginx/FastCGI relay used to reach the isolated segment. Fires on outbound DNS/connections to the single-letter GS-Netcat relay pattern <a-z>.gs.thc.org and on HTTP proxying through a compromised Nginx server to the FastCGI 'uptime'/fcgiwrap execution bridge.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1573, T1571, T1572, T1090.001
• Data sources: stream:dns, zeek:dns, zeek:http, pan:traffic, DeviceNetworkEvents
• Severity: critical
• Confidence: high

Splunk SPL

index=network (sourcetype="stream:dns" OR sourcetype="named" OR sourcetype="zeek:dns" OR sourcetype="pan:traffic" OR sourcetype="zeek:http")
| eval q=coalesce(query, dns_query, http_host, host)
| rex field=q "^(?<sub>[a-z])\.gs\.thc\.org$"
| eval relay_hit=if(isnotnull(sub),1,0)
| eval fastcgi_hit=if(match(coalesce(uri,uri_path,cs_uri_stem,""),"(?i)(fcgiwrap|/uptime)") AND match(coalesce(http_user_agent,""),".*"),1,0)
| where relay_hit=1 OR (sourcetype="zeek:http" AND fastcgi_hit=1)
| stats count min(_time) as firstTime max(_time) as lastTime values(q) as indicators values(dest_ip) as dest by src_ip, host
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| eval reason="GS-Netcat relay (*.gs.thc.org) or Nginx/FastCGI air-gap relay (Velvet Ant Operation Highland)"
| table firstTime lastTime src_ip host indicators dest count reason

Microsoft KQL

// Sentinel — GS-Netcat relay DNS + FastCGI air-gap relay
let dns = (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteUrl matches regex @"^[a-z]\.gs\.thc\.org$"
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, Indicator="gs-netcat-relay"
);
let fastcgi = (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName in~ ("nginx","fcgiwrap","uptime")
    | where RemoteUrl has_any ("uptime","fcgiwrap") or RemotePort in (80,443,8080)
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, Indicator="nginx-fastcgi-relay"
);
union dns, fastcgi
| order by Timestamp desc

Sigma

title: GS-Netcat C2 Egress to *.gs.thc.org Relay Pattern (Velvet Ant Operation Highland)
id: 8f3c1a2e-0809-4a03-9b33-gsnetcat0relay
status: experimental
description: Detects outbound DNS resolution or connection to the THC GS-Netcat relay pattern (single a-z letter subdomain of gs.thc.org) used for Velvet Ant's encrypted reverse-shell command-and-control.
references:
    - https://www.sygnia.co/blog/operation-highland-velvet-ant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573
    - attack.t1571
    - attack.t1572
logsource:
    category: dns
detection:
    selection:
        query|re: '^[a-z]\.gs\.thc\.org$'
    condition: selection
falsepositives:
    - Legitimate use of the THC Global Socket toolkit by red teams (rare; confirm authorization)
level: critical

Known false positives:

• Authorized red-team use of the THC Global Socket / GS-Netcat toolkit — confirm engagement authorization before dismissing

Tuning notes: Add the exact regex ^[a-z]\.gs\.thc\.org$ to perimeter DNS blocklists. For air-gapped segments, alert on ANY Nginx process spawning fcgiwrap/uptime as a child, since that bridge should not exist in production.

• 🔒 Hardcoded Backdoor Password & PAM Auth Anomaly (Exploitation) · unlock with TL Creds
• 🔒 Auth-Stack Persistence — Chrome-Masquerade Systemd Unit, SysVinit & authorized_keys Injection (Post-Exploitation) · unlock with TL Creds
• 🔒 Kernel-Thread Process Masquerade — GS-Netcat as [indicator]/[indicator] & SOCKS5 as [indicator] (C2 / Lateral Movement) · unlock with TL Creds
• 🔒 Dynamic-Linker RPATH Hijack in Auth Shared Objects (Exploitation) · unlock with TL Creds
• 🔒 Credential-Harvest Log Format & Network Sniffing Capture (Post-Exploitation) · unlock with TL Creds
• 🔒 GS-Netcat Implant File & Nginx FastCGI Air-Gap Bridge (C2 / Lateral Movement) · unlock with TL Creds
• 🔒 Backdoored [indicator] — Anomalous RPATH Build String & Auth-Module Tampering (Exploitation) · unlock with TL Creds
• 🔒 Trojanized OpenSSH Binary Tampering & Hidden Credential-Harvest Log (Exploitation) · unlock with TL Creds

Indicators of compromise for Velvet Ant OpenSSH kauditd shell

As of 2026-06-15, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-0809.

How Velvet Ant OpenSSH kauditd shell works

Lateral access was maintained via a modified GS-Netcat reverse shell masquerading as auditd ([kauditd]) and a Perl SOCKS5 proxy masquerading as smbd -D, with HTTP relaying through a compromised Nginx server to reach the internet-disconnected segment.

Operation Highland is a China-nexus cyber-espionage intrusion documented by incident-response firm Sygnia in June 2026 and attributed to Velvet Ant, a state-sponsored threat actor previously tracked weaponizing legacy F5 BIG-IP appliances (PlugX/VELVETSTING/VELVETTAP internal C2) and exploiting CVE-2024-20399 in Cisco NX-OS to deploy the VELVETSHELL backdoor. In this campaign the actor compromised a major organization and persisted for nearly a decade — forensic artifacts and the oldest keylogging activity trace back to 2016 — by subverting the core Linux authentication stack rather than relying on conventional implants.

The centerpiece is a set of nine backdoored pam_unix.so PAM modules. The attackers patched the pam_sm_authenticate function so it would either accept a hardcoded backdoor password (Pamauth@123456), silently harvest credentials from legitimate authentication attempts, or both. After a successful backdoor authentication the module overwrote the backdoor password string in memory with NULL bytes to frustrate memory-forensic recovery. A custom embedded flag disabled the attacker's own credential and session logging so their activity left no recorded evidence. The trojanized modules were identifiable by anomalous RPATH strings betraying the build environment, including paths such as /home/kevin/Desktop/Linux-PAM-{version}/libpam/.libs:/lib64 and /c/src/Linux-PAM-{version}/libpam/.libs.

Alongside PAM, Velvet Ant trojanized OpenSSH components. Newer variants modified ssh, sshd, ssh-keygen, and scp; older variants modified ssh and sshd. A '-d' runtime flag disabled credential logging and keylogging, and a '!' flag hid the scp process. Harvested credentials were written to log files such as /usr/sbin/.ssh.log and an encrypted credential dump at /usr/share/man9/ph/.ph.man (keylogging directory /usr/share/man9/ph/), with older variants storing data under /var/lib/sam/ and /usr/lib/eth-scsi/libethscsi.so. The credential log format encoded direction, authentication type (B=Kerberos, C=PAM, X=SSH2), and status as [Direction][AuthType][Status]-user@IP:port->password.

For remote access, a modified GS-Netcat reverse shell was deployed as /usr/sbin/auditd (also observed as auditdb) and overwrote its own process name to masquerade as the legitimate kernel thread [kauditd] (also khubd), connecting to a relay matching the THC GS-Netcat pattern %.gs.thc.org. A custom Perl SOCKS5 proxy ran as a daemon masquerading as smbd -D, using different filenames and ports on each host to tunnel traffic into systems not directly reachable from the internet. A custom binary named 'uptime' acted as a FastCGI execution bridge, and the actor reconfigured a compromised internet-facing Nginx server to proxy specially crafted HTTP requests to a compromised backend, enabling command execution into the otherwise air-gapped network. Persistence used systemd unit files in /lib/systemd/system/ (one disguised as a Chrome service) on newer servers, appended execution lines in /etc/init.d/ SysVinit scripts on older servers, and injection of attacker SSH public keys into authorized_keys for password-less access.

Remediation was operationally hazardous: removing the backdoored authentication components risked breaking authentication, locking out legitimate administrators, and causing outages, so Sygnia built test labs and validation procedures and advised rotating credentials only after persistence was fully removed. No CVE is associated with this intrusion — it relies on trojanizing legitimate authentication software, not exploiting a specific vulnerability.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1056.001 Keylogging; T1110.001 Password Guessing; T1556 Modify Authentication Process

Lateral Movement

T1021.004 SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1036.004 Masquerade Task or Service; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp

Persistence

T1037.004 RC Scripts; T1098.004 SSH Authorized Keys; T1543.002 Systemd Service; T1554 Compromise Host Software Binary; T1556.003 Pluggable Authentication Modules

credential-access

T1040 Network Sniffing

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573 Encrypted Channel

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

defense-impairment

T1556.003 Pluggable Authentication Modules; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs

stealth

T1574.006 Dynamic Linker Hijacking

Remediation for Velvet Ant OpenSSH kauditd shell

Immediate actions

• Hunt for backdoored pam_unix.so modules: verify package integrity (rpm -V / debsums) and inspect RPATH strings (e.g. readelf -d) for anomalies such as '/home/kevin/Desktop/Linux-PAM-*/libpam/.libs:/lib64' or '/c/src/Linux-PAM-*/libpam/.libs'
• Search for the GS-Netcat implant at /usr/sbin/auditd and /usr/sbin/auditdb and for processes spoofing the [kauditd]/khubd kernel-thread names
• Block outbound connections to the GS-Netcat relay pattern *.gs.thc.org at the perimeter
• Audit /lib/systemd/system/ and /etc/init.d/ for unauthorized units/scripts (including any disguised as a Chrome service) and inspect all authorized_keys files for unrecognized public keys
• Verify integrity of OpenSSH binaries (ssh, sshd, ssh-keygen, scp) against trusted package hashes
• Look for SOCKS5 proxy daemons masquerading as 'smbd -D' on non-standard ports and a FastCGI bridge binary named 'uptime'

Workarounds

• Where backdoored authentication components are found, build a test/validation lab and stage rollback options before remediation to avoid lockout and outages
• Rotate all credentials only after attacker persistence is fully removed

Longer-term hardening

• Treat PAM, OpenSSH, LSASS, and all privileged authentication paths as critical security controls with file-integrity monitoring and signed-package enforcement
• Deploy EDR on all supported systems, including legacy and isolated hosts
• Enable high-confidence alerts for modification of authentication and system files
• Segment and monitor internet-facing relay points (e.g. Nginx) that border isolated networks

Affected and fixed versions

• Linux-PAM — pam_unix.so (PAM authentication module)
  Vulnerable versions: trojanized builds replacing legitimate module
  Fixed in: reinstall verified vendor package
• OpenSSH — OpenSSH (ssh, sshd, ssh-keygen, scp binaries)
  Vulnerable versions: trojanized binaries replacing legitimate builds
  Fixed in: reinstall verified vendor package
• Generic — Linux servers (systemd and SysVinit based)
  Vulnerable versions: newer servers (systemd); older servers (SysVinit)

Timeline of Velvet Ant OpenSSH kauditd shell

• 2016-01-01 Earliest forensic artifacts and oldest keylogging activity place Velvet Ant's presence in the environment at 2016, beginning a near-decade-long undetected intrusion (Sygnia).
• 2017-01-01 Backdoored authentication-stack persistence (locked-ioc-24 and trojanized OpenSSH) established across compromised hosts, enabling credential theft and hardcoded-password backdoor access into the isolated network.
• 2024-06-17 Sygnia publicly documents prior Velvet Ant activity abusing legacy F5 BIG-IP appliances as internal C2 (PlugX, VELVETSTING, VELVETTAP), establishing the actor's profile and attribution.
• 2024-07-01 Velvet Ant linked to exploitation of CVE-2024-20399 (Cisco NX-OS) to deploy the VELVETSHELL backdoor on Cisco Nexus switches — context for the actor's network-device tradecraft.
• 2026-06-08 Sygnia publishes the technical 'Operation Highland' report detailing the backdoored locked-ioc-24 modules, trojanized OpenSSH suite, GS-Netcat implant, and Nginx/FastCGI relay used to reach the isolated network.
• 2026-06-13 Initial reporting circulates describing a China-nexus actor hiding in a Linux login system for nearly a decade.
• 2026-06-15 Sygnia issues remediation guidance: treat PAM/OpenSSH/privileged paths as critical controls, build validation labs before removing backdoored auth components, and rotate credentials only after persistence is fully removed.
• 2026-06-15 Mainstream security press (Cyber Security News, BleepingComputer, Help Net Security, GBHackers, SC World) covers the Operation Highland backdoored PAM/OpenSSH credential-theft campaign.

Sources cited for Velvet Ant OpenSSH kauditd shell

• Velvet Ant's Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected sygnia.co · Vendor report · 2026-06-15
• China-Nexus Threat Group 'Velvet Ant' Abuses F5 Load Balancers (prior campaign / attribution context) sygnia.co · Vendor report · 2024-06-17
• China-Nexus Hackers Use Backdoored PAM Modules for Credential Theft and Authentication Bypass cybersecuritynews.com · News · 2026-06-15
• Chinese hackers hijack auth flow, spy on isolated network for a decade BleepingComputer · News · 2026-06-15
• China-linked spies backdoored authentication stack to stay hidden for years Help Net Security · News · 2026-06-15
• Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network gbhackers.com · News · 2026-06-15
• China-nexus group hid in Linux login system for nearly a decade scworld.com · News · 2026-06-15
• Hackers use F5 BIG-IP malware to stealthily steal data for years (Velvet Ant prior activity) BleepingComputer · News · 2024-06-17

Threats related to Velvet Ant OpenSSH kauditd shell

• Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence
• RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update
• PamDOORa: Commercialized PAM-Abuse Backdoor for SSH Credential Theft on Linux — Evolution of the Plague / pam_exec Technique Lineage

Related coverage of this activity

• APT37 Ted & CurlRAT

More from Velvet Ant

• ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise

Previous and next in malware

• SearchJack: 23 Malicious Chrome Extensions Hijack Search Queries via chrome_settings_overrides (Yahoo Affiliate Monetization) Next report