Linux's Login Layer Hosted an APT Group for Almost a Decade: The Anatomy of Operation Highland

The best part of a security operation is how it showcases how clever the attacker was. The scariest part is realizing that while you were admiring the cleverness, the defensive side failed to spot it for years. Operation Highland, detailed by Sygnia in June 2026, is exactly that kind of story: a backdoor embedded inside the Linux login system, persisting from 2016 to 2026, almost a full decade of undetected presence.

In this article, we will look at why "the software that validates usernames and passwords" can become the most trusted spy of an entire organization, what that means for the Linux ecosystem, and how an ordinary system administrator can detect this kind of compromise on their own systems.

The Attack in Brief: What Happened?

Israeli cybersecurity firm Sygnia tracked a China-nexus APT group it calls Velvet Ant. The earliest traces of the group's presence in the targeted network go all the way back to 2016. The most striking part of the attack is this: the target network was not directly exposed to the internet. The adversary had to first compromise a separate, internet-facing system before it could sit down inside.

According to Sygnia's published report, the attacker used an internet-exposed web server in the target's environment as a bridge. From that web server, the attacker could relay commands and open remote sessions deep inside the segmented network that had no direct outbound access. This is a classic "lateral movement from an outside pivot" story. The genuinely unsettling part begins after that initial foothold.

PAM and OpenSSH: The Compromise of the Inner Keep

When it comes to authentication in the Linux world, two components come to mind: PAM (Pluggable Authentication Modules) and OpenSSH. PAM is the layer that checks the password when you log in, that enforces session policies, that decides whether the person typing at the keyboard is who they claim to be. OpenSSH is the software that provides secure remote shell access; the overwhelming majority of Linux servers are administered over SSH.

After gaining internal access, the attacker did not go down the conventional "drop new malware" path. Instead, it modified these two trusted components themselves. In other words, the attacker rewrote the system's own authentication mechanism to let itself through. Let that sink in for a moment:

The primary PAM login module was replaced with versions that accepted a secret password as a backdoor credential.
Some variants quietly recorded the real usernames and passwords of users logging in.
The OpenSSH client and server binaries were altered to log every credential typed and every command run during a session.
A hidden switch was added to disable the logging on demand, so the attacker could erase its tracks whenever it wanted.

Researchers identified nine distinct versions of the backdoor. That is not the signature of a one-off hack. That is the signature of a long-running software project, iterated and adapted over years by a dedicated team.

Why Was It So Effective?

Take a moment to think this through. In a typical attack scenario, an antivirus or EDR agent spots a malicious file, raises an alert, and incident response kicks in. Operation Highland had no file, no process, no network traffic to flag. All authentication was being performed by the operating system's own trusted components, so everything looked normal.

That is why:

Password resets did not work, because the new passwords were being validated by compromised code.
Killing user sessions did not help, because any new session would be created through the same backdoored code.
Network isolation only cut off external command-and-control, but the local backdoor remained in place.

Cleanup is also extremely delicate. If a system administrator accidentally breaks the original PAM module during remediation, nobody — including the admins themselves — can log in. That is why Sygnia recommends verification rather than patching: compare files against known-good copies, run integrity checks, and only then replace.

What Has Velvet Ant Done Before?

This group is not new. Sygnia's report shows the same actor has historically targeted infrastructure layers that defenders rarely scrutinize:

Early 2024: Internet-exposed F5 BIG-IP appliances were compromised and turned into internal command-and-control servers. Load balancers are typically considered trusted, and because they handle traffic, they are rarely inspected for outbound anomalies.
Mid-2024: CVE-2024-20399 was used to plant a backdoor on Cisco NX-OS switches. The vulnerability requires existing administrative access, so it is a persistence mechanism, not an initial access vector. Cisco patched it in July 2024, and CISA flagged active exploitation the very next day.

The pattern repeats every time: pick the layer defenders watch least and trust the most. Operation Highland simply took that logic to the deepest possible layer — the login system itself.

What Does This Mean for Linux?

Linux's "more secure" reputation rests on a few real foundations: open source code, smaller attack surface, fewer targeted threats, configuration flexibility. All of that is true. But Operation Highland shows that we also need to interrogate which specific layers of Linux we are trusting.

In the Linux world, security advice is often summarized as "keep your packages up to date." Patches for vulnerabilities like CVE-2024-20399 are important, yes. But this case shows that the threat can be entirely outside the patch management process. The attacker did not use the package manager. It did not pull updates from official channels. After getting in, it modified files by hand.

To defend against this kind of threat:

Integrity monitoring: Use AIDE, Tripwire, OSSEC, or similar tools to periodically check the hashes of PAM, OpenSSH, sudo, and other critical binaries. Get an alert when something changes outside the package manager.
Harden your egress points: Web servers, mail servers, VPN appliances, anything that faces the public internet. These are the jumping-off points into the internal network. Stopping the first foothold prevents all the downstream damage.
Reinstall PAM and OpenSSH from official sources: That is, apt reinstall libpam-modules openssh-server or the equivalent on your distribution. This replaces the binaries with the known-good versions, but as noted above, doing it wrong on a live system can lock you out. Test in a non-production environment first, then apply during a maintenance window.
Network segmentation and egress traffic monitoring: If the attacker sets up an internal command server, it has to beacon out at some point. Egress filtering and anomaly detection on outbound traffic catch this.
Move toward a zero-trust model: The "insiders are trusted" assumption is dead. Verify every access request, every command, every session.

What Should the Individual Linux User Do?

Most readers are not running enterprise networks; they have a couple of VPS instances, a home server, maybe a Raspberry Pi. Even at that scale, the same principles apply:

Know which versions of PAM and OpenSSH are running on your servers. If you "trust" the system, you should know what it actually is.
Manually check the PAM modules under /lib/x86_64-linux-gnu/security/ or /lib/security/ (varies by distribution) and /usr/sbin/sshd once in a while. If someone has modified them, the size or timestamp will stand out.
Use key-based SSH authentication only, not passwords. This does not stop an Operation Highland-style attack, but if your password is logged, the attacker still cannot log in without your key.
Consider non-standard SSH ports or port knocking as additional layers. Neither is sufficient on its own, but defense in depth is the point.

Conclusion: Trust Requires Verification

Operation Highland is a reminder of a lesson the security industry keeps forgetting: trusting a system and verifying a system are two different things. PAM and OpenSSH have been the foundation of Linux security for ten years. Most security strategies assumed these components function correctly. Velvet Ant exploited exactly that assumption.

Linux is open source, which means we can review the code, find vulnerabilities as a community, and ship patches quickly. These are real advantages. But they are not enough unless we can guarantee that the running code is the original code. Without integrity verification, file integrity monitoring, and egress traffic inspection, even the most secure operating system can be quietly compromised.

In the next article, we will look at how similar attacks can play out on personal devices and what ordinary Linux users are exposed to without realizing it.

Sources: The Hacker News, "China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade" (June 2026); Sygnia, Operation Highland report.