# Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network

> Sygnia uncovered Operation Highland, a near-decade-long (since ~2016) espionage intrusion by the China-nexus actor Velvet Ant that backdoored the Linux authentication stack — nine distinct pam_unix.so variants and trojanized OpenSSH binaries — to accept a hardcoded password, harvest credentials, and suppress its own logging while operating undetected inside an isolated critical-infrastructure network. Lateral access was maintained via a modified GS-Netcat reverse shell masquerading as auditd ([kauditd]) and a Perl SOCKS5 proxy masquerading as smbd -D, with HTTP relaying through a compromised Nginx server to reach the internet-disconnected segment.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0809
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-velvet-ant-openssh-kauditd-shell-tl-2026-0809.webp?v=8c4639aa (Threadlinqs threat intel: Velvet Ant Trojanized OpenSSH: Detection & IOCs (TL-2026-0809) — High severity, 32 IOCs, 9 detection rules.)
- **ID:** TL-2026-0809
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Velvet Ant (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 32

## Description

Operation Highland is a China-nexus cyber-espionage intrusion documented by incident-response firm Sygnia in June 2026 and attributed to Velvet Ant, a state-sponsored threat actor previously tracked weaponizing legacy F5 BIG-IP appliances (PlugX/VELVETSTING/VELVETTAP internal C2) and exploiting CVE-2024-20399 in Cisco NX-OS to deploy the VELVETSHELL backdoor. In this campaign the actor compromised a major organization and persisted for nearly a decade — forensic artifacts and the oldest keylogging activity trace back to 2016 — by subverting the core Linux authentication stack rather than relying on conventional implants.

The centerpiece is a set of nine backdoored pam_unix.so PAM modules. The attackers patched the pam_sm_authenticate function so it would either accept a hardcoded backdoor password (Pamauth@123456), silently harvest credentials from legitimate authentication attempts, or both. After a successful backdoor authentication the module overwrote the backdoor password string in memory with NULL bytes to frustrate memory-forensic recovery. A custom embedded flag disabled the attacker's own credential and session logging so their activity left no recorded evidence. The trojanized modules were identifiable by anomalous RPATH strings betraying the build environment, including paths such as /home/kevin/Desktop/Linux-PAM-{version}/libpam/.libs:/lib64 and /c/src/Linux-PAM-{version}/libpam/.libs.

Alongside PAM, Velvet Ant trojanized OpenSSH components. Newer variants modified ssh, sshd, ssh-keygen, and scp; older variants modified ssh and sshd. A '-d' runtime flag disabled credential logging and keylogging, and a '!' flag hid the scp process. Harvested credentials were written to log files such as /usr/sbin/.ssh.log and an encrypted credential dump at /usr/share/man9/ph/.ph.man (keylogging directory /usr/share/man9/ph/), with older variants storing data under /var/lib/sam/ and /usr/lib/eth-scsi/libethscsi.so. The credential log format encoded direction, authentication type (B=Kerberos, C=PAM, X=SSH2), and status as [Direction][AuthType][Status]-user@IP:port->password.

For remote access, a modified GS-Netcat reverse shell was deployed as /usr/sbin/auditd (also observed as auditdb) and overwrote its own process name to masquerade as the legitimate kernel thread [kauditd] (also khubd), connecting to a relay matching the THC GS-Netcat pattern %.gs.thc.org. A custom Perl SOCKS5 proxy ran as a daemon masquerading as smbd -D, using different filenames and ports on each host to tunnel traffic into systems not directly reachable from the internet. A custom binary named 'uptime' acted as a FastCGI execution bridge, and the actor reconfigured a compromised internet-facing Nginx server to proxy specially crafted HTTP requests to a compromised backend, enabling command execution into the otherwise air-gapped network. Persistence used systemd unit files in /lib/systemd/system/ (one disguised as a Chrome service) on newer servers, appended execution lines in /etc/init.d/ SysVinit scripts on older servers, and injection of attacker SSH public keys into authorized_keys for password-less access.

Remediation was operationally hazardous: removing the backdoored authentication components risked breaking authentication, locking out legitimate administrators, and causing outages, so Sygnia built test labs and validation procedures and advised rotating credentials only after persistence was fully removed. No CVE is associated with this intrusion — it relies on trojanizing legitimate authentication software, not exploiting a specific vulnerability.

## MITRE ATT&CK

- T1133 External Remote Services
- T1059.004 Unix Shell
- T1556.003 Pluggable Authentication Modules
- T1098.004 SSH Authorized Keys
- T1543.002 Systemd Service
- T1037.004 RC Scripts
- T1554 Compromise Host Software Binary
- T1574.006 Dynamic Linker Hijacking
- T1036.005 Match Legitimate Resource Name or Location
- T1036.004 Masquerade Task or Service
- T1685.006 Clear Linux or Mac System Logs
- T1070.006 Timestomp
- T1685 Disable or Modify Tools
- T1556.003 Pluggable Authentication Modules
- T1556 Modify Authentication Process
- T1056.001 Keylogging
- T1003 OS Credential Dumping
- T1021.004 SSH
- T1090.001 Internal Proxy
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1110.001 Password Guessing
- T1040 Network Sniffing
- T1027 Obfuscated Files or Information
- T1571 Non-Standard Port

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GS-Netcat C2 Egress to *.gs.thc.org & Nginx/FastCGI Air-Gap Relay (C2 / Lateral Movement)** (`TL-2026-0809-SPL-003`)

Detects Velvet Ant's encrypted GS-Netcat reverse-shell C2 and the Nginx/FastCGI relay used to reach the isolated segment. Fires on outbound DNS/connections to the single-letter GS-Netcat relay pattern <a-z>.gs.thc.org and on HTTP proxying through a compromised Nginx server to the FastCGI 'uptime'/fcgiwrap execution bridge.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1573, T1571, T1572, T1090.001
- **Data sources:** stream:dns, zeek:dns, zeek:http, pan:traffic, DeviceNetworkEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype="stream:dns" OR sourcetype="named" OR sourcetype="zeek:dns" OR sourcetype="pan:traffic" OR sourcetype="zeek:http")
| eval q=coalesce(query, dns_query, http_host, host)
| rex field=q "^(?<sub>[a-z])\.gs\.thc\.org$"
| eval relay_hit=if(isnotnull(sub),1,0)
| eval fastcgi_hit=if(match(coalesce(uri,uri_path,cs_uri_stem,""),"(?i)(fcgiwrap|/uptime)") AND match(coalesce(http_user_agent,""),".*"),1,0)
| where relay_hit=1 OR (sourcetype="zeek:http" AND fastcgi_hit=1)
| stats count min(_time) as firstTime max(_time) as lastTime values(q) as indicators values(dest_ip) as dest by src_ip, host
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| eval reason="GS-Netcat relay (*.gs.thc.org) or Nginx/FastCGI air-gap relay (Velvet Ant Operation Highland)"
| table firstTime lastTime src_ip host indicators dest count reason
```

### Microsoft KQL

```kql
// Sentinel — GS-Netcat relay DNS + FastCGI air-gap relay
let dns = (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteUrl matches regex @"^[a-z]\.gs\.thc\.org$"
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, Indicator="gs-netcat-relay"
);
let fastcgi = (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName in~ ("nginx","fcgiwrap","uptime")
    | where RemoteUrl has_any ("uptime","fcgiwrap") or RemotePort in (80,443,8080)
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, Indicator="nginx-fastcgi-relay"
);
union dns, fastcgi
| order by Timestamp desc
```

### Sigma

```yaml
title: GS-Netcat C2 Egress to *.gs.thc.org Relay Pattern (Velvet Ant Operation Highland)
id: 8f3c1a2e-0809-4a03-9b33-gsnetcat0relay
status: experimental
description: Detects outbound DNS resolution or connection to the THC GS-Netcat relay pattern (single a-z letter subdomain of gs.thc.org) used for Velvet Ant's encrypted reverse-shell command-and-control.
references:
    - https://www.sygnia.co/blog/operation-highland-velvet-ant/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573
    - attack.t1571
    - attack.t1572
logsource:
    category: dns
detection:
    selection:
        query|re: '^[a-z]\.gs\.thc\.org$'
    condition: selection
falsepositives:
    - Legitimate use of the THC Global Socket toolkit by red teams (rare; confirm authorization)
level: critical
```

**Known false positives:**

- Authorized red-team use of the THC Global Socket / GS-Netcat toolkit — confirm engagement authorization before dismissing

**Tuning notes:** Add the exact regex ^[a-z]\.gs\.thc\.org$ to perimeter DNS blocklists. For air-gapped segments, alert on ANY Nginx process spawning fcgiwrap/uptime as a child, since that bridge should not exist in production.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Hardcoded Backdoor Password & PAM Auth Anomaly (Exploitation) (locked: unlock with TL Creds)
- Auth-Stack Persistence — Chrome-Masquerade Systemd Unit, SysVinit & authorized_keys Injection (Post-Exploitation) (locked: unlock with TL Creds)
- Kernel-Thread Process Masquerade — GS-Netcat as [indicator]/[indicator] & SOCKS5 as [indicator] (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Dynamic-Linker RPATH Hijack in Auth Shared Objects (Exploitation) (locked: unlock with TL Creds)
- Credential-Harvest Log Format & Network Sniffing Capture (Post-Exploitation) (locked: unlock with TL Creds)
- GS-Netcat Implant File & Nginx FastCGI Air-Gap Bridge (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Backdoored [indicator] — Anomalous RPATH Build String & Auth-Module Tampering (Exploitation) (locked: unlock with TL Creds)
- Trojanized OpenSSH Binary Tampering & Hidden Credential-Harvest Log (Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Velvet Ant's Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected](https://www.sygnia.co/blog/operation-highland-velvet-ant/)
- [China-Nexus Hackers Use Backdoored PAM Modules for Credential Theft and Authentication Bypass](https://cybersecuritynews.com/china-nexus-hackers-use-backdoored-pam-modules/)
- [Chinese hackers hijack auth flow, spy on isolated network for a decade](https://www.bleepingcomputer.com/news/security/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade/)
- [China-linked spies backdoored authentication stack to stay hidden for years](https://www.helpnetsecurity.com/2026/06/15/velvet-ant-backdoored-authentication-persistence/)
- [Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network](https://gbhackers.com/velvet-ant-hackers-backdoor-openssh/)
- [China-nexus group hid in Linux login system for nearly a decade](https://www.scworld.com/brief/china-nexus-group-hid-in-linux-login-system-for-nearly-a-decade)
- [China-Nexus Threat Group 'Velvet Ant' Abuses F5 Load Balancers (prior campaign / attribution context)](https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/)
- [Hackers use F5 BIG-IP malware to stealthily steal data for years (Velvet Ant prior activity)](https://www.bleepingcomputer.com/news/security/hackers-use-f5-big-ip-malware-to-stealthily-steal-data-for-years/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0809