Velvet Ant "Operation Highland": subverting the Linux authentication stack for a decade
Background. Velvet Ant is a China-nexus espionage actor Sygnia has tracked across several long-dwell intrusions, most prominently a multi-year campaign that abused legacy Cisco Nexus switch persistence and F5 BIG-IP appliances as internal footholds to survive repeated eradication attempts (Sygnia — Velvet Ant prior reporting). The throughline across those engagements is patience and a preference for living in places defenders rarely image or hash-verify: network gear, load balancers, and now the host authentication layer. Operation Highland extends that pattern from network appliances to the Linux login path itself.
Sygnia's Operation Highland report, relayed in detail by The Hacker News on 12 June, describes Velvet Ant maintaining covert access to an air-gapped network for nearly a decade, with the earliest traces around 2016 (The Hacker News, 2026-06-12; Sygnia — Operation Highland). Because the target network had no direct internet connectivity, the group first compromised internet-facing perimeter hosts and engineered a deliberate multi-stage path inward — there was no single exploit, just abuse of trusted administration once inside.
The core of the operation is subversion of the components that decide who may log in. Velvet Ant deployed nine distinct compiled variants of pam_unix.so — the primary PAM password module — across hosts. Some variants accept a hard-coded magic password that grants access as any user while leaving normal authentication intact; others silently write the real credentials typed by legitimate users to disk for later harvesting (T1556.003 — Modify Authentication Process: Pluggable Authentication Modules). In parallel, the sshd/ssh binaries were replaced with backdoored copies that log every username, password and command, and carry an attacker flag to suppress that logging during the operators' own sessions (T1554 — Compromise Host Software Binary). Harvested credentials then enable ordinary-looking authenticated movement (T1078 — Valid Accounts; T1021.004 — Remote Services: SSH), and the trojanised modules are placed at their legitimate paths under /lib/security/ and /usr/sbin/ so nothing looks out of place (T1036.005 — Masquerading: Match Legitimate Name or Location).
The defensive lesson is the part worth internalising: this class of compromise is invisible to the telemetry most SOCs rely on. A backdoored pam_unix.so produces no failed-login events, spawns no anomalous child process, and drops no second-stage userland implant for EDR to catch — the malice lives inside a trusted system library behaving normally for everyone except the attacker. Password resets and standard IR containment do not evict it, because the authentication decision itself is owned by the adversary. Detection therefore has to move to filesystem and binary integrity rather than behaviour:
- Verify the on-disk
pam_unix.so,sshdandsshbinaries against authoritative package-manager checksums —rpm -V openssh-server/dpkg --verify openssh-serveron every Linux host, and a hash comparison of/lib/security/pam_unix.so(and the distro's PAM module directory) against the package-provided value. Any mismatch or unexpected modification timestamp on these files is a triage trigger, not a curiosity. - Deploy file-integrity monitoring (AIDE, Tripwire, or equivalent) on the authentication components specifically, and put OS auth-stack changes under separate change management so a legitimate update is distinguishable from tampering. On Linux endpoints with file-creation telemetry (Sysmon for Linux EID 11), alert on modification of
/lib/security/pam_unix.soand/usr/sbin/sshd. - Threat-hunt the credential-harvesting side effect: look for successful SSH logins that coincide with unusual source IPs or off-hours timing, and remember that PAM-module replacement will not generate failed-login noise to anchor on. Hunt for unexpected credential-log files left in world-writable or dot-prefixed locations.
Hardening that removes or shrinks the attack path: immutable OS partitions or dm-verity for high-value isolated systems so authentication binaries cannot be silently rewritten; FIM in detect-and-block mode on the auth stack; and, for genuinely air-gapped networks, outbound filtering on the internet-facing pivot hosts the actor needs to stage the multi-step path inward. The strategic takeaway for a public-sector SOC: your Linux fleet's pam_unix.so and sshd are as much a crown-jewel integrity target as your domain controllers, and almost certainly far less monitored.
ATT&CK mapping
8 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1554Compromise Host Software Binary
Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
T1556Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.
T1556.003Modify Authentication Process: Pluggable Authentication Modules
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1036Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
T1036.005Masquerading: Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Defense Impairment TA0112
T1556Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.
T1556.003Modify Authentication Process: Pluggable Authentication Modules
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.
Credential Access TA0006
T1556Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.
T1556.003Modify Authentication Process: Pluggable Authentication Modules
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.
Lateral Movement TA0008
T1021Remote Services
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
T1021.004Remote Services: SSH
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.