Inside Operation Highland: How Velvet Ant Hid in the Linux Login for a Decade

Israel-based incident response firm Sygnia has published findings from an investigation dubbed Operation Highland that exposes one of the most disciplined and long-running cyber espionage campaigns in recent memory. The activity is attributed with high confidence to a China-nexus threat group Sygnia tracks as Velvet Ant. The operation is defined not by a single novel zero-day, but by a relentlessly simple idea: live inside the software that decides who gets to log in.

The Decade-Long Intrusion, Step by Step

The victim network had no direct internet connection and housed highly sensitive systems. Sygnia’s forensic timeline indicates the attackers gained a foothold at least as far back as 2016, giving the group close to a ten-year dwell time inside the environment .

Initial entry point. The breach likely began through an internet-facing, unpatched legacy F5 BIG-IP appliance that the organization had not retired. Once the attackers had control of the appliance, they used it as a pivot point to move deeper — eventually reaching the air-gapped internal segment .

How the Backdoor Worked

Instead of dropping custom malware that file scanners or endpoint detection might eventually flag, Velvet Ant subverted the operating system's own trust architecture. Across dozens of hosts, the group systematically replaced core Linux authentication components — specifically the pam_unix.so pluggable authentication module and multiple OpenSSH binaries — with trojanized versions .

This substitution provided two capabilities from a single implant:

1. Master password bypass. The backdoored modules contained a hardcoded secret password. Any user account could be accessed with this password alone, completely bypassing normal authentication. Even if administrators rotated every user credential, the attackers could still walk through the front door .
2. Silent credential harvesting. Every legitimate login event was captured in real time. The clear-text passwords of every authenticating user were written to a hidden file located at /usr/share/awk/nullfile.awk. This allowed Velvet Ant to collect valid credentials across the entire user base without additional lateral movement noise .

Why Standard Cleanup Failed

Traditional incident response playbooks are not built for an enemy that has recompiled your operating system's login binaries. Sygnia's report makes it clear why the first several cleanup attempts failed:

• Cleanup gap. The standard workflow — remove suspicious files, kill malicious processes, rotate all passwords — had zero effect on the attacker's primary persistence mechanism. The trojanized pam_unix.so and SSH binaries were legitimate system files in every sense except their compiled logic .
• Metadata masking. The attackers preserved the original filenames, paths, timestamps, and approximately the same file sizes. Any file-integrity check that relied solely on file metadata — which is common in many enterprise environments — saw nothing wrong .
• Password rotation futility. Because the hardcoded master password lived inside the authentication module itself, resetting every user's credentials did nothing to lock the adversary out .
• Self-reinstating design. Evidence gathered during the investigation indicated the backdoor was built to survive partial remediation. If the security team cleaned several hosts but left the authentication stack compromised on others, the group could move laterally again and re-compromise the rebuilt machines .

Sygnia's ultimate remediation step was unambiguous: the network required a full operating-system rebuild of every affected host from known-good, read-only media. Selective file removal or partial reimaging was insufficient .

The Tradecraft Pattern

Velvet Ant's success does not rely on exotic attack chains. Instead, the group demonstrates a mature operational playbook focused on patience and authentication-layer camouflage.

Operational Pattern	Observed Behavior
Network-edge initial access	Exploits unpatched enterprise appliances — notably F5 BIG-IP and Cisco Nexus switches — that are exposed to the internet as bridgeheads into internal networks .
Authentication subversion as primary implant	Avoids deploying conventional remote access trojans (RATs) on endpoints and instead replaces the components that validate user logins across the Linux fleet .
Redundant persistence mesh	Maintains multiple footholds across different network segments so that the loss of one access point — or even one entire appliance — does not terminate the operation .
Living-off-the-land	Moves laterally using stolen credentials and standard administrative tools such as SSH, leaving minimal custom malware signatures for detection tools to find .
Industrial-scale credential harvesting	Captures plain-text passwords from every successful login across the network, steadily accumulating valid identities with no additional network noise .
Extreme dwell time	Operates over years rather than days or weeks. This low-and-slow tempo means short log-retention windows and routine system maintenance can erase forensic evidence .

Attribution and Related Activity

Sygnia attributes Operation Highland to Velvet Ant with high confidence and links the group to Chinese state-sponsored espionage objectives . The group focuses on large organizations in East Asia, particularly telecommunications providers and critical infrastructure .

Prior and parallel campaigns provide additional context. In a separate case, Velvet Ant used legacy F5 BIG-IP appliances as command-and-control (C2) proxies for at least three years before Sygnia's investigation uncovered the activity . The group has also been observed deploying PlugX and ShadowPad malware during earlier intrusions, indicating a broad toolkit that spans both custom and publicly available capabilities .

What Defenders Should Do Now

The single most important defense lesson from Operation Highland is that traditional endpoint protection and credential rotation are not enough when the authentication stack itself is untrustworthy.

Defenders should prioritize file integrity monitoring that compares cryptographic hashes of critical system binaries — including /lib/security/pam_unix.so and SSH daemon binaries — against known-good baselines, not just file metadata. Logging all authentication events centrally to an immutable, external system is also essential, because an attacker with sufficient access can tamper with on-host logs. Multi-factor authentication remains a valuable barrier, but it does not directly protect against a backdoored PAM service that bypasses authentication checks entirely.

Operation Highland shows that the most dangerous persistence doesn't look like malware at all — it looks like the login prompt you trust every day.