Velvet Ant Used Backdoored PAM and OpenSSH to Spy on Isolated Network
Summary
Sygnia reports that Velvet Ant began targeting internet-facing servers in 2016 and built access into an isolated network, using a custom proxy and Nginx/FastCGI path before backdooring PAM and OpenSSH to steal credentials and monitor administrative activity.
Key points
- Sygnia attributes Operation Highland, a campaign it describes as lasting about 10 years, to the Velvet Ant threat group.
- The reported intrusion began with internet-facing systems and later reached an isolated critical infrastructure network.
- A modified GS-Netcat shell and custom SOCKS5 proxy provided persistence, remote access, and internal network tunneling.
- Velvet Ant reportedly chained Nginx configuration changes and a FastCGI process to create a remote-execution path into the isolated environment.
- Backdoored PAM modules reportedly accepted hardcoded passwords and harvested credentials; trojanized OpenSSH tools captured credentials and logged commands.
- Sygnia says cleanup required lab testing, host profiling, and rollback planning to reduce the risk of authentication failures and operational outages.
- Recommended defenses include monitoring authentication components for unauthorized changes, hardening privileged access, MFA, and tested offline recovery.
Article Details
- Attack Vectors
- Velvet Ant initially compromised internet-facing servers; the article does not identify a specific product or vulnerability used for this access.
- A modified GS-Netcat reverse shell connected to a hardcoded relay domain, which the article does not name. It persisted through a malicious systemd service or startup-script modification.
- A custom SOCKS5 proxy on compromised servers provided tunneling and internal pivot points.
- Nginx configuration changes chained requests through a compromised backend to a FastCGI process, which launched a custom binary and established SSH connections into the isolated network.
- Backdoored PAM modules accepted hardcoded passwords and harvested credentials. Trojanized OpenSSH components captured credentials, logged SSH commands, and stored collected data locally.
- Defensive Notes
- Treat authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets.
- Use EDR, file integrity monitoring, hardened privileged access, MFA, and continuous monitoring for unauthorized modifications.
- Plan for offline recovery with regularly created immutable backups; test backups, recovery hosts, operating systems, and recovery scripts.
- For cleanup of replaced critical components, profile hosts, validate the binary replacement process in a test environment, and prepare rollback procedures before remediation.
MITRE ATT&CK
T1005 · Data from Local SystemTrojanized OpenSSH components stored captured credentials and command logs locally for later retrieval.T1021.004 · SSHThe custom 'uptime' binary established SSH connections to systems in the isolated network.T1036.005 · Match Legitimate Resource Name or LocationThe proxy daemon masqueraded as 'smbd -D'.T1037 · Boot or Logon Initialization ScriptsThe modified shell could also persist through startup-script changes.T1059.004 · Unix ShellThe modified GS-Netcat reverse shell provided shell access, and the FastCGI execution path launched a custom binary on compromised Linux systems.T1090.001 · Internal ProxyVelvet Ant installed a custom SOCKS5 proxy on compromised servers to tunnel traffic and pivot to internal systems.T1543.002 · Systemd ServiceThe modified GS-Netcat shell persisted through a malicious systemd service.T1556.003 · Pluggable Authentication ModulesBackdoored PAM modules accepted hardcoded passwords and harvested credentials.
Threat Actors
Products
F5 BIG-IPVelvet Ant’s lengthy espionage operations were documented in 2024, when Sygnia warned of a campaign targeting F5 BIG-IP devices that operated undetected for three years.NGINXThey built a remote execution path into the segregated environment through chained Nginx and FastCGI changes.NX-OSAlso in 2024, Cisco warned of a zero-day in NX-OS running on Nexus switches, which was exploited by Velvet Ant to gain access to targets.OpenSSHThe attackers used modified access tools, backdoored PAM modules, and trojanized OpenSSH components to maintain persistence, steal credentials, and observe all administrative activity.PAMThe attackers used modified access tools, backdoored PAM modules, and trojanized OpenSSH components to maintain persistence, steal credentials, and observe all administrative activity.