Velvet Ant Linux login-layer persistence campaign
Campaign
Summary
Hide ▲
Show ▼
A Velvet Ant campaign was uncovered that quietly maintained access by backdooring Linux PAM and OpenSSH components, putting credential capture and command logging inside the login path. The operation used internet-facing systems as a bridge into an isolated network and left traces dating to 2016. Because the compromised software controlled authentication itself, ordinary cleanup and password resets would not reliably remove the foothold or stop reuse of stolen credentials.
Related Happenings
Cisco Catalyst SD-WAN unauthorized peering and SSH access campaign
Campaign
H score38
First: 25.06.2026 17:15
Last: 25.06.2026 17:15
Sources 1
About this happening:
An active campaign used unauthorized peering connections and SSH access to maintain footholds inside a service provider's Cisco Catalyst SD-WAN environment, increa...
Cisco Catalyst SD-WAN unauthorized peering and SSH access campaign
CampaignAbout this happening: An active campaign used unauthorized peering connections and SSH access to maintain footholds inside a service provider's Cisco Catalyst SD-WAN environment, increa...
Organization hit by network compromise linked to Velvet Ant
Incident
H score35
First: 13.06.2026 17:06
Last: 13.06.2026 17:06
Sources 1
How related:
Chinese hackers took control of a target organization's authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity.
About this happening:
A target organization suffered a 10-year authentication stack compromise that exposed administrative activity inside an isolated critical infrastructure network. T...
Organization hit by network compromise linked to Velvet Ant
IncidentHow related: Chinese hackers took control of a target organization's authentication stack and maintained persistence for 10 years, with full visibility into the administrative activity.
About this happening: A target organization suffered a 10-year authentication stack compromise that exposed administrative activity inside an isolated critical infrastructure network. T...
Velvet Ant Linux PAM and OpenSSH backdoor analysis
Technical Analysis
H score32
First: 12.06.2026 21:17
Last: 12.06.2026 21:17
Sources 1
How related:
Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in
About this happening:
Researchers documented a long-running Velvet Ant compromise of Linux PAM and OpenSSH login components, exposing credential theft and covert persistence across isolat...
Velvet Ant Linux PAM and OpenSSH backdoor analysis
Technical AnalysisHow related: Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in
About this happening: Researchers documented a long-running Velvet Ant compromise of Linux PAM and OpenSSH login components, exposing credential theft and covert persistence across isolat...
UNC5221 Brickstorm, Plenet, and AgentPSD access-maintenance malware activity
Malware Activity
H score16
First: 05.06.2026 21:09
Last: 05.06.2026 21:09
Sources 1
About this happening:
The Brickstorm malware set enabled UNC5221 / VerdantBamboo to keep long-term access inside victim infrastructure, including Microsoft 365, raising the risk of stealthy...
UNC5221 Brickstorm, Plenet, and AgentPSD access-maintenance malware activity
Malware ActivityAbout this happening: The Brickstorm malware set enabled UNC5221 / VerdantBamboo to keep long-term access inside victim infrastructure, including Microsoft 365, raising the risk of stealthy...
PamDOORa Linux backdoor with persistent SSH access and credential theft
Malware Activity
H score27
First: 08.05.2026 11:41
Last: 08.05.2026 11:41
Sources 1
About this happening:
The PamDOORa backdoor has been disclosed as a PAM-based Linux implant that can create persistent SSH access and steal credentials, raising post-compromise risk on Li...
PamDOORa Linux backdoor with persistent SSH access and credential theft
Malware ActivityAbout this happening: The PamDOORa backdoor has been disclosed as a PAM-based Linux implant that can create persistent SSH access and steal credentials, raising post-compromise risk on Li...
Timeline
-
12.06.2026 21:17 3 articles · 1mo ago
Velvet Ant backdoors Linux PAM and OpenSSH login components
Initial DisclosureSygnia says Velvet Ant backdoored the PAM and OpenSSH login path on an isolated Linux network, replacing trusted authentication components to capture credentials and log commands while staging through internet-facing systems to reach internal hosts. The activity left traces dating to 2016 and showed persistence inside the authentication layer rather than through separate malware.
Show sources
- China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade — thehackernews.com — 12.06.2026 21:17
- China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade — thehackernews.com — 12.06.2026 21:17
- Chinese hackers hijack auth flow, spy on isolated network for a decade — www.bleepingcomputer.com — 13.06.2026 17:06