INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Chinese hackers hijack auth flow, spy on isolated network for 10 years

| 2026-06-12 18:17 CRITICAL MEDIUM
JSON
Executive Summary AI-generated
The Velvet Ant cyberespionage threat group has been active for over a decade, conducting sophisticated attacks on isolated critical infrastructure networks of large organizations. Their tactics have evolved significantly over time, with the most recent campaign dubbed "Operation Highland" beginning in 2016 and targeting vulnerable internet-facing systems before pivoting to an air-gapped environment. This campaign was attributed by Sygnia researchers who discovered it, highlighting the group's persistence and credential theft capabilities. The attack chain involves multiple vectors, including compromised internet-facing servers, reverse shell exploitation using GS-Netcat, and network traffic tunneling through custom SOCKS5 proxies. These tactics have been used in conjunction with authentication components such as PAM, OpenSSH, and Windows LSASS to establish a remote-execution path into the segregated environment. The Velvet Ant threat group's ability to adapt and evolve their tactics has allowed them to maintain persistence for extended periods, making them a significant concern for organizations worldwide.
Technical Mitigations AI-generated
* Implement secure coding practices and input validation to prevent the use of malicious code, such as GS-Netcat reverse shells or custom SOCKS5 proxies. * Regularly update and patch Linux systems, including PAM modules and OpenSSH components, to ensure that known vulnerabilities are addressed before they can be exploited by threat actors like Velvet Ant. * Use secure authentication mechanisms, such as multi-factor authentication (MFA) or password policies with strong requirements, to prevent attackers from gaining unauthorized access to critical infrastructure networks. * Monitor network traffic for suspicious activity and implement intrusion detection systems (IDS) or firewalls to detect and block potential threats before they can be exploited by Velvet Ant or other threat actors.
AI Podcast (EN) detail_available
detail_listen_ai (EN)
Intelligence distributed on:
Incident Link
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation HighlandOperation Highland Velvet AntVelvet Ant CVE-2024-20399CVE-2024-20399
Target & Sectors
Global Scope
Incident Timeline
‎July 2024
Chinese hackers exploited a vulnerability in Cisco's authentication software and gained unauthorized access to an isolated network for nearly a decade.
‎Jun 12, 2026
Chinese hackers exploited a vulnerability in an isolated network to hijack its authentication flow and spy on users for over a decade.
‎2026/06/12
Chinese hackers hijack auth flow, spy on isolated network for a decade.
infrastructure Linux
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade.
 Swati Khandelwal  Jun 12, 2026 Linux / Network Security Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself.
"By chaining these modifications, Velvet Ant established a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection to the critical infrastructure network ever required." - Sygnia Having established their access into the isolated environment, Velvet Ant shifted focus to long-term persistence and credential theft by targeting Linux Pluggable Authentication Modules (PAM), a set of libraries that let administrators set up methods to authenticate users.
organisation Linux / Network Security
 Swati Khandelwal  Jun 12, 2026 Linux / Network Security Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself.
threat_actor Velvet Ant
Chinese hackers of the “Velvet Ant” activity cluster breached the isolated critical infrastructure network of a large organization and conducted cyber-espionage operations for 10 years.
"By chaining these modifications, Velvet Ant established a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection to the critical infrastructure network ever required." - Sygnia Having established their access into the isolated environment, Velvet Ant shifted focus to long-term persistence and credential theft by targeting Linux Pluggable Authentication Modules (PAM), a set of libraries that let administrators set up methods to authenticate users.
Dubbed "Operation Highland," the intrusion is attributed to the Velvet Ant cyberespionage threat group, which targeted vulnerable internet-facing systems before pivoting to a network with no direct external path.
Sygnia, which tracks the group as Velvet Ant , says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it.
Each time defenders find one foothold, Velvet Ant moves to gear they watch less and sets up there.
Velvet Ant’s lengthy espionage operations were documented in 2024, when Sygnia warned of a campaign targeting F5 BIG-IP devices that operated undetected for three years.
Also in 2024, Cisco warned of a zero-day in NX-OS running on Nexus switches, which was exploited by Velvet Ant to gain access to targets.
Velvet Ant attack chain The attack begins with the compromise of internet-facing servers, though the researchers don’t mention the specific product or any vulnerability used.
Velvet Ant deployed a modified GS-Netcat reverse shell disguised as a legitimate system component that connected to a hardcoded relay domain, providing encrypted remote shell access.
Dissasembler showing the use of GS-Netcat Source: Sygnia Next, Velvet Ant installed a custom SOCKS5 proxy for network traffic tunneling, enabling it to reach internal systems that are not directly accessible from the internet.
To achieve this, Velvet Ant modified the configuration of a compromised internet-facing Nginx server to proxy specially crafted requests to a compromised backend server.
Velvet Ant actors also replaced OpenSSH components such as ssh, sshd, and scp with trojanized versions that captured credentials, logged commands entered during SSH sessions, and stored the collected data locally for future retrieval.
" Complex cleanup Sygnia says even after discovering the compromise, remediating it and removing Velvet Ant from the compromised environment was particularly complicated.
organisation PAM
"By chaining these modifications, Velvet Ant established a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection to the critical infrastructure network ever required." - Sygnia Having established their access into the isolated environment, Velvet Ant shifted focus to long-term persistence and credential theft by targeting Linux Pluggable Authentication Modules (PAM), a set of libraries that let administrators set up methods to authenticate users.
Sygnia, which tracks the group as Velvet Ant , says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it.
organisation Operation Highland
Operation Highland is not a one-CVE problem.
organisation Sygnia
The campaign, dubbed “Operation Highland” by Sygnia researchers who discovered it, began in 2016, targeting vulnerable internet-facing systems before pivoting to an “air-gapped” environment with no direct internet connection.
Sygnia, which tracks the group as Velvet Ant , says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it.
organisation Nexus
Also in 2024, Cisco warned of a zero-day in NX-OS running on Nexus switches, which was exploited by Velvet Ant to gain access to targets.
organisation GS
Velvet Ant deployed a modified GS-Netcat reverse shell disguised as a legitimate system component that connected to a hardcoded relay domain, providing encrypted remote shell access.
organisation Nginx
To achieve this, Velvet Ant modified the configuration of a compromised internet-facing Nginx server to proxy specially crafted requests to a compromised backend server.
infrastructure Windows
Sygnia recommends that defenders treat authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets and protect them with EDR, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications.
organisation EDR
Sygnia recommends that defenders treat authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets and protect them with EDR, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications.
organisation MFA
Sygnia recommends that defenders treat authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets and protect them with EDR, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications.
organisation SSH
The tool established SSH connections to systems within the isolated critical infrastructure network using parameters supplied in HTTP POST requests.
Tactical Metrics
Metrics
infrastructure
‎Linux
Affected Product
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade.
 Swati Khandelwal  Jun 12, 2026 Linux / Network Security Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself.
"By chaining these modifications, Velvet Ant established a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection to the critical infrastructure network ever required." - Sygnia Having established their access into the isolated environment, Velvet Ant shifted focus to long-term persistence and credential theft by targeting Linux Pluggable Authentication Modules (PAM), a set of libraries that let administrators set up methods to authenticate users.
Metrics
infrastructure
‎Windows
Affected Product
Sygnia recommends that defenders treat authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets and protect them with EDR, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications.
Intelligence Sources
The Hacker News 2026-06-12
BleepingComputer 2026-06-13
BleepingComputer 2026-06-13
The Hacker News 2026-06-12