Summary
Sygnia’s new Operation Highland report describes a China-nexus Velvet Ant intrusion that maintained access inside an internal network for nearly a decade, with forensic artifacts dating back to 2016. The standout detail is the access path: the target environment had no direct internet connectivity, so the operators staged through internet-facing systems and then pivoted step by step into the segregated network.
Once inside, the actor replaced PAM modules and OpenSSH binaries with backdoored variants that enabled credential theft, authentication bypass, keylogging, and stealthy persistence. Sygnia says the group also modified SSH tooling to suppress logging of its own sessions, appended keys for passwordless access, and built multiple tailored variants of the malicious login stack across the victim environment.
Source
Commentary
This is why red-teamers and defenders both obsess over identity and admin paths: once an operator owns PAM and SSH, incident response becomes dangerous because the very tools used to recover access may already be poisoned. The campaign also shows how patient operators will route around segmentation instead of attacking it head on.
For offensive teams, the report is a reminder that persistence in authentication layers creates asymmetric leverage. For blue teams, it is a warning to monitor core trust components like pam_unix.so, sshd, authorized_keys, and jump-host workflows with the same seriousness normally reserved for domain controllers.