Sygnia Says Velvet Ant Backdoored Linux PAM and OpenSSH Since 2016
Summary
Sygnia reports that China-nexus group Velvet Ant altered Linux PAM and OpenSSH components to steal credentials and maintain access to isolated networks. The activity dates to at least 2016; defenders are advised to verify system files and remove backdoors before resets.
Key points
- Sygnia tracks the China-nexus group as Velvet Ant and says its activity dates back to at least 2016, including on networks without direct internet access.
- The group reportedly replaced PAM login modules and modified OpenSSH programs rather than relying on obvious new malware.
- Researchers found nine versions of the backdoored components; some PAM variants allowed access using a secret password, while others recorded login credentials.
- The modified OpenSSH programs reportedly logged credentials and commands, with a hidden switch to disable logging.
- To reach isolated segments, the group reportedly used disguised tools and an internet-facing web server as a bridge for commands and remote sessions.
- Sygnia warns that password resets and ending sessions are ineffective while compromised login components remain; it recommends monitoring and verifying files against known-good copies, then removing backdoors before resetting passwords.
Article Details
- Attack Vectors
- Velvet Ant reportedly replaced Linux PAM login modules with backdoored copies that could allow access through a secret password or record users’ credentials.
- The group altered OpenSSH programs to record credentials and commands typed during sessions.
- To reach an isolated network without direct internet access, the attacker used an internet-facing web server as a bridge to pass commands and open remote sessions.
- In a separate 2024 incident, Sygnia reported that the group exploited CVE-2024-20399 on Cisco NX-OS switches to install a backdoor; the article says the flaw required prior administrator access.
- Defensive Notes
- Monitor PAM and OpenSSH programs and their key files for unexpected changes, and compare them against known-good copies.
- Remove backdoors before resetting passwords, since compromised login components could capture replacement credentials.
- Test replacement login components in a lab before deploying them to avoid locking administrators out of live systems.
- Patch CVE-2024-20399 on Cisco Nexus gear and monitor F5 appliances for unexpected outbound connections.
MITRE ATT&CK
T1090.001 · Internal ProxyThe attacker reportedly used an internet-facing web server as a bridge to pass commands and open remote sessions into an isolated internal network.T1556.003 · Pluggable Authentication ModulesThe group reportedly backdoored Linux PAM login modules, including copies that accepted a secret password or recorded credentials entered during login.
CVE
Threat Actors
Vendors
Products
Cisco NexusThe earlier F5 and Cisco cases have their own checks: patch CVE-2024-20399 on Cisco Nexus gear, and watch F5 boxes for unexpected outbound connections.Cisco NX-OSLater that year, it reported the group exploiting a Cisco NX-OS flaw, CVE-2024-20399, to plant a backdoor on the switches.F5 BIG-IPIn a 2024 case, Sygnia found the same actor turning internet-exposed F5 BIG-IP appliances into internal command servers.LinuxSygnia says China-nexus group Velvet Ant spent nearly a decade hiding inside Linux login components, backdooring PAM and OpenSSH to steal credentials and maintain access on isolated networks.OpenSSHSygnia says China-nexus group Velvet Ant spent nearly a decade hiding inside Linux login components, backdooring PAM and OpenSSH to steal credentials and maintain access on isolated networks.PAMSygnia says China-nexus group Velvet Ant spent nearly a decade hiding inside Linux login components, backdooring PAM and OpenSSH to steal credentials and maintain access on isolated networks.