A Decade-Long Auth Breach: Velvet Ant Taps Air-Gapped Network for Espionage
Velvet Ant's Operation Highland spent a decade in an organization’s air-gapped network after pivoting from internet-facing hosts, hijacking authentication by replacing PAM modules and OpenSSH components with backdoors, and building a remote-execution path via modified Nginx/FCGI to issue commands over HTTP; initial access used a GS-Netcat reverse shell and a SOCKS5 proxy to reach internal systems; this gave attackers full visibility into admin activity and allowed credential theft, with persistence surviving password resets; remediation is complex and requires hardening PAM/OpenSSH, MFA, EDR, FIM, offline immutable backups, rigorous testing, and rollback planning.