🤚 The Open-Palm Intrusion Report

A Chinese state-sponsored hacking group called Velvet Ant compromised a critical infrastructure organization’s authentication system and maintained full access for ten years — from 2016 to 2026 — without anyone noticing. The campaign, dubbed Operation Highland by the researchers at Sygnia who finally discovered it, represents one of the longest-running nation-state intrusions ever documented.

The target was a large organization operating critical infrastructure with an air-gapped network — the kind of environment that security architects design specifically to be unreachable from the outside. Velvet Ant reached it anyway, because air gaps are only as good as the humans who maintain them, and humans are terrible.

Here’s how it worked:

• Initial access: Velvet Ant compromised vulnerable internet-facing servers and deployed a modified GS-Netcat reverse shell disguised as a legitimate system component, connecting to hardcoded relay domains for encrypted remote access
• Lateral movement: Custom SOCKS5 proxies running as daemons masquerading as smbd -D — different filenames and ports on each host — converted compromised servers into internal pivot points
• Bridge to the air gap: Modified Nginx configurations on internet-facing and backend servers, chaining them with FastCGI processes to create a remote-execution path into the segregated environment via simple HTTP requests, with no direct connection ever required
• Authentication takeover: Replaced legitimate pam_unix.so modules with backdoored versions that accept hardcoded passwords and harvest every credential that passes through them

Sygnia identified nine distinct variants of the malicious PAM module, each compiled in a separate build environment. They also trojanized OpenSSH components — ssh, sshd, and scp — to capture credentials and log commands in real time.

👐 The Two-Handed Technical Dissection

Let us pause to appreciate the craftsmanship, if that’s the right word for a decade of illegal surveillance.

The genius — and we use that term with the appropriate amount of horror — was targeting the Linux Pluggable Authentication Modules. PAM is the component that decides whether you’re allowed to log in. It’s the front door, the ID check, and the guest list, all in one library. When you backdoor PAM, you don’t need to crack passwords. You become the password.

Every time a legitimate administrator logged in, Velvet Ant harvested their credentials. Every time someone changed their password, the new password was captured too. Password rotations — that sacred ritual of corporate security compliance — were not a defense. They were a credential delivery mechanism.

And because the attackers also trojanized SSH itself, they could see every command typed on every compromised host. They didn’t just have access. They had omniscience. Every administrative action across the entire environment was visible to a team of people in a different country, in real time, for ten years.

Nine separate PAM variants, each compiled in its own build environment. That’s not hacking. That’s a software development lifecycle. Velvet Ant had better release engineering than most startups.

🌿 The Gentle Awakening

There is a particularly uncomfortable truth embedded in this story, and it’s not about Chinese espionage. It’s about us.

This organization had an air-gapped network. It had authentication systems. It presumably had security audits, compliance reviews, penetration tests, and a budget line item for “cybersecurity” that grew every fiscal year. And none of it mattered, because the attackers didn’t go around the security — they went through the authentication layer itself, replaced the lock with their own lock, and then watched everyone use it for a decade.

The remediation, according to Sygnia, was extraordinarily complicated. You can’t just delete the malicious PAM modules and call it a day, because you might lock out every legitimate user in the process. The organization needed extensive testing, rollback procedures, and offline recovery planning to safely remove a threat that had literally become part of the login process.

When the malware is the authentication system, cleaning it up requires rebuilding the concept of trust from scratch.

👑 The Gold-Leaf Reckoning

Ten years. That’s not a breach — it’s a tenancy agreement. Velvet Ant moved in, redecorated, and had better uptime than most SaaS products.

The lesson here is not “update your systems” or “audit your PAM modules” — although, yes, obviously do both of those things. The lesson is that the most dangerous attacks don’t trigger alerts because they don’t look like attacks. They look like normal authentication events. They look like an administrator logging in with the correct password, because the correct password is whatever the attacker decided it should be.

Air gaps are a security architecture. They are not a security guarantee. When a nation-state with ten years of patience and nine different build environments decides your network is interesting, your network segmentation becomes a suggestion.

And somewhere in the world right now, there is another PAM module that doesn’t match the hash it shipped with, on a server that passed its last compliance audit with flying colors, in an organization that sleeps soundly because its network is “isolated.”

Sleep tight.

“The air gap said ‘no entry,’ the Nginx config said ‘actually, yes,’ and the PAM module said ‘welcome back, it’s been ten years and I’ve never felt more appreciated.’ Your compliance certificate is in the mail.” — The Slap of Wisdom Incident Response Team, replacing its own authentication modules with a healthy sense of existential dread