Velvet Ant "Operation Highland": China-Nexus APT Backdoors the Linux Authentication Layer, Hiding for Nearly a Decade

Executive Summary Velvet Ant — a China-nexus APT tracked by Sygnia — modified the very components that decide "who is allowed to sign in" on Linux systems: the PAM library (pam_unix.so) and OpenSSH bi