Product
PAM
- First Reported
- Jun 13, 2026
- Latest Reported
- Jun 13, 2026
Reported Context (2)
- The attackers used modified access tools, backdoored PAM modules, and trojanized OpenSSH components to maintain persistence, steal credentials, and observe all administrative activity. Velvet Ant Used Backdoored PAM and OpenSSH to Spy on Isolated Network
- Sygnia says China-nexus group Velvet Ant spent nearly a decade hiding inside Linux login components, backdooring PAM and OpenSSH to steal credentials and maintain access on isolated networks. Sygnia Says Velvet Ant Backdoored Linux PAM and OpenSSH Since 2016
CVE (1)
Threat Actors (1)
MITRE ATT&CK (8)
Vendors (2)
Products (7)
Tools (2)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.