Instead of hiding on the laptops and servers that defenders monitor most closely, a China-linked group spent nearly a decade concealed within the Linux login system itself.
Sygnia, which refers to the group as Velvet Ant, says it compromised the PAM and OpenSSH components responsible for determining who can log in, embedding its access where standard cleanup could not reach it. The targeted network lacked direct internet connectivity, so the group first gained entry through internet-facing systems to reach it.
The earliest evidence dates back to 2016. Rather than deploying new malware that a scanner might detect, the attacker modified the trusted login programs themselves. Nothing suspicious was immediately apparent, and no exploit was required, making the activity appear like routine administration.
On numerous machines, the attacker replaced the primary PAM login module with compromised versions. Some allowed entry using a secret password, while others quietly recorded legitimate usernames and passwords as users logged in.
Researchers identified nine distinct versions. The OpenSSH programs were modified in the same manner, logging credentials and every command entered, with a hidden feature to disable that logging when necessary.
Reaching the isolated network at all demanded extra effort. The attacker employed other disguised tools and an internet-facing web server as a relay, sending commands through it to establish remote sessions deep within the segment that had no direct internet access.
Because the login system itself was compromised, standard containment measures were ineffective. Password resets and terminated sessions offer no benefit when the system that checks those credentials is working for the attacker.
This is not a novel tactic for the group. Each time defenders discover one foothold, Velvet Ant shifts to equipment they monitor less and establishes itself there. In a 2024 case, Sygnia found the same actor turning internet-exposed F5 BIG-IP appliances into internal command servers.
Later that year, it reported the group exploiting a Cisco NX-OS vulnerability, CVE-2024-20399, to implant a backdoor on the switches. That bug requires admin access first, so it serves as a persistence tool rather than a remote break-in. Cisco patched it in July 2024, and CISA flagged it as exploited the next day.
Operation Highland follows the same concept, one level deeper. Load balancers, switches, and the login software itself are trusted by default and seldom inspected, which is precisely why a patient attacker hides within them.
Operation Highland is not a single-CVE issue. The attacker altered trusted programs after gaining access, so the solution is verification rather than patching, and cleanup is tricky: a wrong replacement can lock admins out of a live system.
Monitor the login files. Keep an eye on the PAM and OpenSSH programs and their key files for any changes, and issue alerts when they change.
Hunt by checking what has changed, not by waiting for an alert. Compare these programs against known-good copies, because nothing will flag them for you.
Remove the backdoor before resetting passwords, or the new ones will be stolen the same way. Test any replacement in a lab first.
The earlier F5 and Cisco cases have their own checks: patch CVE-2024-20399 on Cisco Nexus gear, and watch F5 boxes for unexpected outbound connections.
The broader lesson is clear: infrastructure that falls outside normal monitoring still requires integrity checks, and that now includes the login layer.