China-Nexus Hackers Exploit Backdoored PAM Modules for Credential Theft

Key Takeaways

• A China-linked threat actor, “Velvet Ant,” maintained undetected access to a major organization’s isolated critical infrastructure network for nearly a decade, starting as early as 2017.
• The attackers bypassed authentication and stole credentials by deploying backdoored Pluggable Authentication Modules (PAM), specifically modifying `pam_unix.so` to include hardcoded passwords and harvest legitimate login attempts.
• Velvet Ant utilized sophisticated techniques, including custom modifications to public tools like GS-Netcat, masquerading as legitimate system processes, and employing multi-stage access chains to bridge internet-facing systems with an air-gapped environment.
• The operation, dubbed “Operation Highland,” highlights the critical need for robust monitoring of authentication layers, system files, and privileged access paths, even in highly segregated networks.

A persistent and highly sophisticated threat actor, identified as Velvet Ant and linked to China, managed to remain undetected within a major organization’s internal network for nearly a decade. This prolonged intrusion, now designated “Operation Highland,” showcased an extraordinary level of patience and technical prowess, particularly given the target network’s lack of direct internet connectivity.

The attackers did not rely on common entry vectors like phishing or brute-force attacks. Instead, Velvet Ant meticulously engineered a multi-stage access chain, enabling them to transition from internet-exposed systems into a highly isolated critical infrastructure environment. Their tactics included modifying publicly available tools to mimic legitimate system activity, thereby evading conventional security measures.

According to a report from Sygnia analysts, shared with Cyber Security News (CSN), forensic evidence indicates the intrusion began as early as 2017. Sygnia’s incident response team, tasked with reconstructing the attack, found that Velvet Ant consistently adapted its methods. Upon detection, the group would shift to less-monitored infrastructure, re-establishing persistence from a new vantage point within the compromised network.

A distinguishing feature of Operation Highland was the attackers’ decision to embed their persistence directly within the authentication layer, rather than relying on typical backdoors. This allowed for deeply entrenched access that was difficult to uncover.

China-Nexus Hackers Use Backdoored PAM Modules

Once Velvet Ant successfully breached the segregated environment, their primary target became the Pluggable Authentication Module (PAM) layer, a fundamental Linux component responsible for user authentication across various services. The investigation uncovered nine instances of a maliciously altered `pam_unix.so` file on compromised hosts, replacing the legitimate PAM module.

The attackers specifically modified the `pam_sm_authenticate` function. This function, which ordinarily validates a username and password, was patched to either accept a hardcoded backdoor password, harvest legitimate credentials during authentication attempts, or both. When the backdoor password was used, the normal verification process was entirely bypassed. To further hinder forensic analysis, the malicious library would overwrite the backdoor password string in memory with NULL values after successful bypass.

Adding another layer of stealth, the threat actor incorporated a custom flag designed to disable their own credential and session logging. This allowed Velvet Ant to operate within the network without leaving a trace of their activities, making attribution and incident response significantly more challenging.

Modified OpenSSH Binaries and Lateral Movement

Beyond PAM manipulation, Velvet Ant deployed a customized version of GS-Netcat on internet-facing servers. This modified binary, named `auditd` and placed in `/usr/sbin/`, was used to establish a reverse shell connection to a remote command-and-control (C2) server. The choice of filename and location was a deliberate attempt to blend in with legitimate system utilities.

To further obscure its presence, the malicious `auditd` binary would overwrite its own process name in system listings with `[kauditd]`, mimicking a legitimate kernel thread and thereby avoiding detection by standard process monitoring tools.

Velvet Ant employed different persistence mechanisms depending on the server’s operating system. On newer servers utilizing systemd, a malicious unit file was planted in `/lib/systemd/system/`, disguised as a Chrome service. For older SysVinit servers, a malicious execution line was appended to startup scripts located in `/etc/init.d/`. Additionally, the attackers added their public keys to `authorized_keys` files on compromised servers, securing persistent, password-less access.

What You Should Do

• Strengthen Authentication Layers: Treat PAM, OpenSSH, LSASS, and all privileged access paths as critical security controls. Implement stringent monitoring and integrity checks for these components.
• Deploy EDR: Ensure Endpoint Detection and Response (EDR) solutions are deployed on all supported systems to gain comprehensive endpoint visibility and robust detection capabilities.
• Enable High-Confidence Alerts: Configure security information and event management (SIEM) systems and EDRs to generate high-confidence alerts for any modifications to authentication mechanisms or critical system files.
• Harden Privileged Access: Implement strict hardening measures for all privileged access paths, including multi-factor authentication (MFA), least privilege principles, and regular auditing.
• Secure Credential Rotation: Only rotate credentials after confirming that all persistence mechanisms have been fully removed from compromised systems.
• Plan for Remediation: When remediating authentication components, ensure rollback options and emergency access plans are in place to prevent administrators from being locked out of production systems.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.