Initial entry point. The breach likely began through an internet-facing, unpatched legacy F5 BIG-IP appliance that the organization had not retired. Once the attackers had control of the appliance, they used it as a pivot point to move deeper — eventually reaching the air-gapped internal segment .

How the Backdoor Worked

Instead of dropping custom malware that file scanners or endpoint detection might eventually flag, Velvet Ant subverted the operating system's own trust architecture. Across dozens of hosts, the group systematically replaced core Linux authentication components — specifically the pam_unix.so pluggable authentication module and multiple OpenSSH binaries — with trojanized versions .

This substitution provided two capabilities from a single implant:

1. Master password bypass. The backdoored modules contained a hardcoded secret password. Any user account could be accessed with this password alone, completely bypassing normal authentication. Even if administrators rotated every user credential, the attackers could still walk through the front door .
2. Silent credential harvesting. Every legitimate login event was captured in real time. The clear-text passwords of every authenticating user were written to a hidden file located at /usr/share/awk/nullfile.awk. This allowed Velvet Ant to collect valid credentials across the entire user base without additional lateral movement noise .

Why Standard Cleanup Failed

Traditional incident response playbooks are not built for an enemy that has recompiled your operating system's login binaries. Sygnia's report makes it clear why the first several cleanup attempts failed:

• Cleanup gap. The standard workflow — remove suspicious files, kill malicious processes, rotate all passwords — had zero effect on the attacker's primary persistence mechanism. The trojanized pam_unix.so and SSH binaries were legitimate system files in every sense except their compiled logic .
• Metadata masking. The attackers preserved the original filenames, paths, timestamps, and approximately the same file sizes. Any file-integrity check that relied solely on file metadata — which is common in many enterprise environments — saw nothing wrong .
• Password rotation futility. Because the hardcoded master password lived inside the authentication module itself, resetting every user's credentials did nothing to lock the adversary out .
• Self-reinstating design. Evidence gathered during the investigation indicated the backdoor was built to survive partial remediation. If the security team cleaned several hosts but left the authentication stack compromised on others, the group could move laterally again and re-compromise the rebuilt machines .

Sygnia's ultimate remediation step was unambiguous: the network required a full operating-system rebuild of every affected host from known-good, read-only media. Selective file removal or partial reimaging was insufficient .

The Tradecraft Pattern

Velvet Ant's success does not rely on exotic attack chains. Instead, the group demonstrates a mature operational playbook focused on patience and authentication-layer camouflage.

Attribution and Related Activity

Sygnia attributes Operation Highland to Velvet Ant with high confidence and links the group to Chinese state-sponsored espionage objectives . The group focuses on large organizations in East Asia, particularly telecommunications providers and critical infrastructure .

Prior and parallel campaigns provide additional context. In a separate case, Velvet Ant used legacy F5 BIG-IP appliances as command-and-control (C2) proxies for at least three years before Sygnia's investigation uncovered the activity . The group has also been observed deploying PlugX and ShadowPad malware during earlier intrusions, indicating a broad toolkit that spans both custom and publicly available capabilities .

What Defenders Should Do Now

The single most important defense lesson from Operation Highland is that traditional endpoint protection and credential rotation are not enough when the authentication stack itself is untrustworthy.

Defenders should prioritize file integrity monitoring that compares cryptographic hashes of critical system binaries — including /lib/security/pam_unix.so and SSH daemon binaries — against known-good baselines, not just file metadata. Logging all authentication events centrally to an immutable, external system is also essential, because an attacker with sufficient access can tamper with on-host logs. Multi-factor authentication remains a valuable barrier, but it does not directly protect against a backdoored PAM service that bypasses authentication checks entirely.

Operation Highland shows that the most dangerous persistence doesn't look like malware at all — it looks like the login prompt you trust every day.

Initial entry point. The breach likely began through an internet-facing, unpatched legacy F5 BIG-IP appliance that the organization had not retired. Once the attackers had control of the appliance, they used it as a pivot point to move deeper — eventually reaching the air-gapped internal segment .

How the Backdoor Worked

Instead of dropping custom malware that file scanners or endpoint detection might eventually flag, Velvet Ant subverted the operating system's own trust architecture. Across dozens of hosts, the group systematically replaced core Linux authentication components — specifically the pam_unix.so pluggable authentication module and multiple OpenSSH binaries — with trojanized versions .

This substitution provided two capabilities from a single implant:

1. Master password bypass. The backdoored modules contained a hardcoded secret password. Any user account could be accessed with this password alone, completely bypassing normal authentication. Even if administrators rotated every user credential, the attackers could still walk through the front door .
2. Silent credential harvesting. Every legitimate login event was captured in real time. The clear-text passwords of every authenticating user were written to a hidden file located at /usr/share/awk/nullfile.awk. This allowed Velvet Ant to collect valid credentials across the entire user base without additional lateral movement noise .

Why Standard Cleanup Failed

Traditional incident response playbooks are not built for an enemy that has recompiled your operating system's login binaries. Sygnia's report makes it clear why the first several cleanup attempts failed:

• Cleanup gap. The standard workflow — remove suspicious files, kill malicious processes, rotate all passwords — had zero effect on the attacker's primary persistence mechanism. The trojanized pam_unix.so and SSH binaries were legitimate system files in every sense except their compiled logic .
• Metadata masking. The attackers preserved the original filenames, paths, timestamps, and approximately the same file sizes. Any file-integrity check that relied solely on file metadata — which is common in many enterprise environments — saw nothing wrong .
• Password rotation futility. Because the hardcoded master password lived inside the authentication module itself, resetting every user's credentials did nothing to lock the adversary out .
• Self-reinstating design. Evidence gathered during the investigation indicated the backdoor was built to survive partial remediation. If the security team cleaned several hosts but left the authentication stack compromised on others, the group could move laterally again and re-compromise the rebuilt machines .

Sygnia's ultimate remediation step was unambiguous: the network required a full operating-system rebuild of every affected host from known-good, read-only media. Selective file removal or partial reimaging was insufficient .

The Tradecraft Pattern

Velvet Ant's success does not rely on exotic attack chains. Instead, the group demonstrates a mature operational playbook focused on patience and authentication-layer camouflage.

Attribution and Related Activity

Sygnia attributes Operation Highland to Velvet Ant with high confidence and links the group to Chinese state-sponsored espionage objectives . The group focuses on large organizations in East Asia, particularly telecommunications providers and critical infrastructure .

Prior and parallel campaigns provide additional context. In a separate case, Velvet Ant used legacy F5 BIG-IP appliances as command-and-control (C2) proxies for at least three years before Sygnia's investigation uncovered the activity . The group has also been observed deploying PlugX and ShadowPad malware during earlier intrusions, indicating a broad toolkit that spans both custom and publicly available capabilities .

What Defenders Should Do Now

The single most important defense lesson from Operation Highland is that traditional endpoint protection and credential rotation are not enough when the authentication stack itself is untrustworthy.

Defenders should prioritize file integrity monitoring that compares cryptographic hashes of critical system binaries — including /lib/security/pam_unix.so and SSH daemon binaries — against known-good baselines, not just file metadata. Logging all authentication events centrally to an immutable, external system is also essential, because an attacker with sufficient access can tamper with on-host logs. Multi-factor authentication remains a valuable barrier, but it does not directly protect against a backdoored PAM service that bypasses authentication checks entirely.

Operation Highland shows that the most dangerous persistence doesn't look like malware at all — it looks like the login prompt you trust every day.