Modified OpenSSH Binaries Let Velvet Ant Steal Passwords, Log Commands, and Hide Activity

A long-running, stealthy campaign attributed to the China-nexus actor tracked as Velvet Ant has been found to include deeply engineered backdoors in the authentication stack: modified OpenSSH binaries and tampered PAM modules that exfiltrate credentials, record every executed command, and conceal attacker activity.

The discovery, part of Sygnia’s Operation Highland investigation, reveals nearly a decade of undetected presence and a deliberate multi-stage access chain used to reach a highly segregated critical infrastructure network that had no direct internet connectivity.

Velvet Ant’s objective was clear: control authentication everywhere so persistence would survive password changes, session terminations, and routine containment efforts.

The intrusion chain progressed in three phases. First, the actor established footholds on internet-facing servers using modified tooling, including a cloaked reverse-shell dubbed auditdb based on GS-Netcat and custom SOCKS5 proxy scripts.

These implants were made persistent via systemd units or modified SysVinit scripts and were deliberately disguised in process lists.

According to Sygnia, forensic timeline places initial activity in this environment as early as 2016. Rather than a single opportunistic intrusion, the operation shows sustained targeting, careful per-host engineering, and the replacement of core authentication components across multiple Linux distributions and versions.

On newer servers running systemd, a malicious unit file was placed in /lib/systemd/system/, disguised as a Chrome service, ensuring the malware executed at boot.

Second, Velvet Ant leveraged web infrastructure compromised Nginx servers and a FastCGI wrapper to execute binaries remotely and bridge into an isolated IT-to-OT environment.

Modified OpenSSH Binaries

Simple HTTP requests became an execution path into the segregated network without direct connectivity.

Third, and most consequentially, the group replaced pam_unix.so modules and OpenSSH binaries with backdoored variants, giving them the ability to accept hardcoded backdoor passwords, harvest credentials, and log interactive commands at scale.

The sshd binary records commands to a file under /usr/share/man9/ph/, using filenames that begin with s followed by the MD5 hash of the connected user and the TTY. 

Analysis uncovered nine distinct backdoored pam_unix.so variants, each compiled in separate build environments evidence of a structured build pipeline and sustained investment.

Some variants accepted a hardcoded password to bypass authentication; others captured legitimate username/password pairs and wrote them to hidden files.

The modified pam modules often attempted to erase traces of the backdoor string in memory, indicating operational security awareness.

Compromised OpenSSH suites included altered ssh, sshd, scp and ssh-keygen binaries. The malicious ssh and sshd recorded both incoming and outgoing authentication attempts saving encrypted credential dumps to obscure paths and keylogged shell input, saving encrypted session logs named by MD5 hashes.

The implants supported attacker-friendly options: a custom -d flag to disable credential and session logging during operator use, an scp option to masquerade the process as a legitimate kernel thread, and the ability to disable SELinux when run as root.

Older variants used rotating MD5-based backdoor hashes keyed to days of the week, showing iterative sophistication over time.

These changes transformed authentication from a control to a covert persistence mechanism. Traditional remediation removing services or rotating credentials becomes hazardous when the code that validates credentials is compromised.

Sygnia notes eradication risk: replacing PAM modules or OpenSSH with the wrong binaries can lock administrators out of critical systems, potentially causing outages in zero-downtime environments that cannot pull packages from the internet.

Defenders should prioritize detection and hardening of authentication components. Deploy EDR where supported and ensure telemetry from isolated networks is collected via approved relays.

Monitor and alert on modifications to PAM modules, OpenSSH binaries, authorized_keys, systemd units, and startup scripts.

Use file-integrity monitoring for critical paths, vault privileged keys, restrict direct root SSH, require named administrative accounts tunneled through hardened jump hosts, and plan offline recovery with validated golden images and rollback procedures.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.