China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Sygnia says Velvet Ant backdoored Linux login components and stayed hidden for years. The group also used web servers and disguised tools to reach isolated networks.
Intelligence analysis by GPT-5.4 Mini
Sygnia says a China-nexus group modified trusted Linux login software, including PAM and OpenSSH, to steal credentials and log commands from inside the login layer itself. The campaign reportedly began in 2016 and was built for persistence, not noisy exploitation.
A sneaky intruder changed the front door lock itself instead of breaking a window. That let them hide for a long time, because every time someone used the door, the lock was secretly helping the intruder.
Analysis
What Sygnia found
Sygnia says the China-linked group it tracks as Velvet Ant compromised Linux systems by replacing PAM login modules and OpenSSH components with backdoored versions. Those altered programs could let the attackers in with a secret password, capture real usernames and passwords, and record commands typed during sessions.
Why this is hard to clean up
The key point is that the login layer itself was modified after the attackers were already inside. That means password resets and session termination are not enough if the software checking those credentials is compromised. Sygnia says it found nine versions of the backdoored PAM module, which suggests the operators were maintaining and evolving the foothold over time.
How they reached the isolated network
The targeted environment reportedly had no direct internet access. To get in anyway, the attackers used internet-facing systems as staging points and passed commands through a web server to open remote sessions deeper inside the segmented network. The article says this made the intrusion look more like normal administration than obvious malware activity.
Broader pattern
Sygnia links this operation to earlier Velvet Ant activity. In 2024, it said the group turned exposed F5 BIG-IP devices into internal command servers. Later that year, it reported exploitation of Cisco NX-OS CVE-2024-20399 to plant a backdoor on switches. The common theme is persistence on trusted infrastructure that defenders may not inspect closely.
Defensive takeaway
The article’s advice is to verify PAM and OpenSSH binaries and key files against known-good copies, hunt for changes rather than waiting for alerts, and remove backdoors before resetting passwords. It also says Cisco Nexus gear should be patched for CVE-2024-20399 and F5 boxes should be monitored for unusual outbound connections.
Key points
- Sygnia says Velvet Ant backdoored PAM and OpenSSH on Linux systems to maintain access.
- The campaign reportedly dates back to 2016 and focused on persistence rather than obvious malware.
- The attackers used internet-facing systems as bridges into an isolated network with no direct internet access.
- Because the login layer was compromised, password resets alone would not stop credential theft.
- The article ties the operation to earlier Velvet Ant activity on F5 BIG-IP and Cisco NX-OS devices.
If defenders follow the article’s guidance, they can catch tampering by comparing login software against known-good copies. Stronger integrity checks on trusted infrastructure could make similar long-running footholds much harder to keep.
If the backdoored login software is missed, attackers can keep stealing credentials and commands even after passwords change. The article also suggests the same actor may keep shifting to other trusted systems, making removal difficult and incomplete.
