Chinese hackers hijack auth flow, spy on isolated network for a decade
Sygnia says Velvet Ant kept spying access inside an isolated critical infrastructure network for 10 years after pivoting from internet-facing systems.
Intelligence analysis by GPT-5.4 Mini
Sygnia says the Velvet Ant group turned compromised internet-facing servers into a bridge into a segregated network, then buried itself inside authentication components so it could watch administrative activity for years.
Hackers found a way from one locked door to another, then hid inside the building’s key system so they could watch who came and went for years. It was like sneaking into a school and secretly changing the sign-in desk instead of just breaking one window.
Analysis
What Sygnia found
Sygnia says the intrusion it calls Operation Highland began in 2016, when Velvet Ant compromised vulnerable systems facing the internet and used them as a stepping stone toward an isolated critical infrastructure network. From there, the attackers built layered access: a modified reverse shell, a custom SOCKS5 proxy for tunneling traffic, and a request chain that let them reach internal systems through HTTP requests without any direct internet path into the protected environment.
How the access worked
The researchers describe a particularly unusual bridge into the segregated network. A compromised Nginx server was altered to forward specially crafted requests to another compromised server, which then handed them off to a FastCGI process. That process launched a custom binary that opened SSH connections to internal hosts using parameters supplied in POST requests. Sygnia says this created a remote-execution path into the isolated network while keeping the critical infrastructure network itself offline from the internet.
Why the persistence was so dangerous
Once inside, Velvet Ant focused on the authentication layer. Sygnia says the group replaced legitimate PAM modules with backdoored versions that accepted hardcoded passwords and collected credentials. The attackers also trojanized OpenSSH components to log credentials and SSH session activity. According to the researchers, this made administrative activity fully visible and embedded access into the login process itself, so the operators could keep going even after password changes or terminated sessions.
Cleanup challenges
Sygnia says removal was hard because so many core binaries had been swapped out that a rushed cleanup could break authentication and lock administrators out. The team built a lab, tested host by host, and prepared rollback plans before attempting remediation. Its advice is to treat authentication software as critical security infrastructure, monitor file integrity, use MFA and EDR, and plan offline recovery with tested backups and snapshots.
Key points
- Sygnia attributes the operation to Velvet Ant and says it lasted for about 10 years.
- Attackers reportedly used compromised internet-facing systems to pivot into an isolated critical infrastructure network.
- The group modified Nginx, FastCGI, PAM, and OpenSSH components to create persistence and observe administrator activity.
- Sygnia says the cleanup was complicated because removing the malicious binaries could break authentication.
- The researchers recommend protecting auth components with EDR, file integrity monitoring, MFA, and tested offline recovery plans.
The report gives defenders a detailed map of how a long-lived intrusion can spread from exposed servers into a segregated network. If organizations apply the recommended monitoring, backups, and integrity checks, they may catch similar tampering earlier and recover more safely.
The article shows that attackers who control authentication can stay hidden even after passwords change, which makes containment much harder. It also suggests that cleanup itself can be risky, because removing tampered login components may disrupt normal administration and operations.
