Loading story…
Sygnia reported that the China-linked threat group Velvet Ant maintained covert access to an organization's network for nearly a decade by modifying trusted Linux authentication components in an intrusion campaign dubbed Operation Highland. Instead of relying on conventional malware, the attackers backdoored PAM and OpenSSH to bypass authentication with a secret password, steal legitimate credentials, and log commands while blending in with normal administrative activity. Researchers identified nine distinct versions of the tampered software, indicating the operation evolved over years and that the earliest observed activity dates back to 2016.
The intrusion reportedly reached an air-gapped or otherwise isolated environment by staging through internet-facing systems and using a web server as a bridge into the segmented network. Sygnia said the case shows why patching and password resets alone are insufficient when trusted login binaries have been altered, and urged defenders to verify the integrity of PAM and OpenSSH files against known-good copies, remove backdoors before resetting credentials, and monitor or patch related edge infrastructure. The tradecraft aligns with Velvet Ant's broader pattern of hiding in trusted systems, including prior activity involving F5 BIG-IP devices and exploitation of CVE-2024-20399 on Cisco NX-OS switches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Sygnia disclosed that Velvet Ant replaced legitimate Linux PAM modules, including pam_unix.so, with trojanized versions that allowed authentication bypass via a hardcoded password and harvested credentials from normal logins. The report also described additional persistence through a disguised GS-Netcat binary, systemd and SysVinit mechanisms, and appended SSH authorized_keys entries.
Sygnia disclosed that Velvet Ant maintained stealthy persistence for nearly a decade by modifying trusted Linux login binaries rather than deploying conventional malware. The researchers said the attackers used internet-facing systems and a web server as a bridge into an air-gapped or isolated environment, and identified multiple tampered software versions.
Sygnia said Velvet Ant's tradecraft matched prior 2024 incidents involving persistence on F5 BIG-IP appliances and exploitation of Cisco NX-OS vulnerability CVE-2024-20399 on switches. The linkage was cited as part of the group's broader pattern of hiding in trusted infrastructure.
Sygnia reported that the earliest observed activity in Velvet Ant's Operation Highland dates to 2016. The China-linked group established long-term access by backdooring Linux PAM and OpenSSH components inside an isolated network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that attackers can abuse Linux **Pluggable Authentication Modules (PAM)** by modifying SSH authentication settings to invoke the `pam_exec` module, turning a legitimate feature into a stealthy credential-theft and persistence mechanism. In the demonstrated technique, a malicious script is triggered during SSH login attempts—including failed authentications—to collect usernames and environment data and send them to a remote host, while standard logs may show only unsuccessful SSH access and not the hidden execution path. The technique affects a core authentication framework used by services such as **`sshd`**, `login`, `su`, and `passwd`, making PAM configuration integrity a high-value defensive priority on Linux systems. Group-IB said the same approach could support backdoors, covert command execution, and long-term persistence, and recommended hardening measures including timely patching, enforcing **SELinux** or **AppArmor**, monitoring with **Auditd** and **Wazuh**, and using tools such as **PSAD**, **AIDE**, and **rkhunter** to detect unauthorized changes and suspicious activity.
Jun 29, 2026
Researchers have disclosed **PamDOORa**, a Linux backdoor that abuses the **Pluggable Authentication Module (PAM)** framework to steal SSH credentials and maintain covert persistence on already-compromised `x86_64` systems. Advertised on the Russian-speaking cybercrime forum **Rehub** by an actor using the alias **"darkworm,"** the malware is positioned as a post-exploitation toolkit and was reportedly offered for sale with its source code. It intercepts credentials from legitimate users during authentication by abusing `pam_exec` and inserting a malicious PAM component into the login stack. PamDOORa also enables hidden SSH access through a **magic password** tied to a specific TCP port, while anti-forensic functions tamper with records such as `lastlog`, `btmp`, `utmp`, and `wtmp` to conceal activity and complicate investigations. Researchers said the malware appears to require prior root-level compromise for deployment, and there is **no confirmed evidence yet of active in-the-wild attacks**, but they described it as a more mature, operator-grade evolution of earlier PAM backdoor concepts because of its modular design, anti-debugging features, network-aware triggers, and builder pipeline.
Jun 29, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026