Velvet Ant Operation Highland, a China-nexus cyberespionage campaign uncovered by Sygnia, saw the threat actor maintain persistent access to a large organisation’s isolated critical infrastructure network from 2016, going undetected for ten years by embedding itself directly into the authentication process.
The campaign is attributed to the Velvet Ant activity cluster, which Sygnia identifies as a China-nexus threat actor. It is not a group that favours speed: previous Velvet Ant operations documented in 2024 included a campaign targeting F5 BIG-IP devices that ran undetected for three years. Operation Highland surpassed that considerably.
How Velvet Ant Operation Highland Bridged the Air Gap
The intrusion began with the compromise of internet-facing servers, though Sygnia does not specify which products or vulnerabilities were used at this initial stage. From there, Velvet Ant deployed a modified GS-Netcat reverse shell disguised as a legitimate system component, connecting to a hardcoded relay domain to provide encrypted remote shell access. Persistence was achieved either via a malicious systemd service or through startup script modification. A custom SOCKS5 proxy, masquerading as ‘smbd -D’, then ran as a daemon to tunnel network traffic and turn compromised servers into internal pivot points, with different filenames and ports used on each host to avoid easy detection.
The more involved engineering came with breaching the air-gapped environment itself. Velvet Ant modified the configuration of a compromised internet-facing Nginx server to proxy specially crafted requests to a compromised backend server. That backend server’s Nginx configuration was then altered to forward requests to a FastCGI process (fcgiwrap) listening on a separate port. The FastCGI wrapper processed incoming requests and launched a custom binary named ‘uptime’, which established SSH connections to systems within the isolated network using parameters supplied via HTTP POST requests.
As Sygnia puts it: ‘By chaining these modifications, Velvet Ant established a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection to the critical infrastructure network ever required.’
Authentication Subverted, Credentials Harvested
Once inside the isolated environment, the group’s focus shifted to long-term persistence and credential theft. The primary mechanism was the subversion of Linux Pluggable Authentication Modules (PAM), the set of libraries that lets administrators configure user authentication methods. Velvet Ant replaced legitimate ‘pam_unix.so’ modules with backdoored versions that accept hardcoded passwords and harvest credentials as they are entered.
Sygnia identified nine distinct variants of the malicious PAM module, each compiled in a separate build environment. Two variants are particularly notable in their design: one acts purely as a backdoor, the other focuses on credential collection. The separate build environments point to a well-resourced operation with careful operational discipline.
OpenSSH components, including ssh, sshd, and scp, were also replaced with trojanised versions that captured credentials, logged commands entered during SSH sessions, and stored the collected data locally for later retrieval. The effect, as Sygnia describes it, was total visibility: ‘Administrative activity became fully observable: every login; every command executed across compromised hosts. Access was no longer tied to a specific foothold but embedded into the authentication process itself.’ Password changes and session terminations did little to dislodge the attackers, as their access was woven into the authentication layer itself.
It is also worth noting that Velvet Ant’s activity extends beyond this campaign. In 2024, Cisco disclosed that the group had exploited CVE-2024-20399, a zero-day vulnerability in NX-OS running on Nexus switches, to gain access to targets, according to Sygnia’s research.
Remediation Required a Test Lab
Even after the compromise was discovered, removing Velvet Ant from the environment was far from straightforward. So many critical system components had been replaced with custom versions that simply deleting them risked breaking authentication entirely, locking out legitimate administrators, and triggering operational outages. Sygnia responded by building a dedicated testing lab to validate the binary replacement process, profiling each host, testing results, and preparing rollback procedures before touching the live environment.
Sygnia recommends that defenders treat PAM, OpenSSH, and Windows LSASS as critical security assets protected by endpoint detection and response (EDR) tools, file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorised modifications. Offline recovery planning, including immutable backup snapshots with tested restoration procedures, should be in place before an incident, not after. Sygnia’s full technical analysis of Operation Highland is published on their blog.
