Chinese hackers hijack auth flow, spy on isolated network for a decade
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Chinese threat group Velvet Ant conducted a decade-long cyberespionage campaign (Operation Highland) against a large organization's air-gapped critical infrastructure network, starting in 2016. The attackers chained compromised internet-facing servers, a custom SOCKS5 proxy, modified Nginx configurations, and FastCGI execution bridges to reach the isolated network without a direct connection. Once inside, they replaced Linux PAM modules and OpenSSH components with backdoored versions that accepted hardcoded passwords, harvested credentials, and logged all administrative commands — effectively embedding persistence into the authentication layer itself. Nine distinct PAM module variants were identified, suggesting a well-resourced actor. Remediation was complex because removing the trojanized components risked breaking authentication entirely, requiring a dedicated test lab and rollback procedures. Defenders are advised to treat PAM, OpenSSH, and Windows LSASS as critical assets and protect them with EDR, file integrity monitoring, MFA, and immutable backups.
