Velvet Ant Spent a Decade Inside an Air-Gapped Network by Subverting Authentication

A decade-long intrusion into an air-gapped critical infrastructure network, uncovered by Sygnia researchers under the label "Operation Highland," illustrates how a well-resourced threat actor can reduce conventional containment measures to near irrelevance once it controls the authentication layer.

The campaign, attributed to the Chinese cyberespionage cluster known as Velvet Ant, began in 2016. Entry points were internet-facing servers, though Sygnia has not disclosed the specific products or vulnerabilities involved. On those perimeter hosts, the attackers deployed a modified GS-Netcat reverse shell disguised as a legitimate system component, connecting back to a hardcoded relay domain over an encrypted channel. The shell maintained persistence by either installing a malicious systemd service or altering startup scripts.

A custom SOCKS5 proxy, masquerading as the process smbd -D and using varying filenames and ports across different hosts, turned each compromised server into a pivot point for reaching systems further inside the network.

The more technically notable step was bridging into the isolated environment without establishing a persistent direct tunnel. Velvet Ant altered the configuration of a compromised internet-facing Nginx server so it would forward specially crafted HTTP requests to a backend server, whose own Nginx configuration was modified to pass those requests to a FastCGI process. That process launched a custom binary named uptime, which in turn opened SSH connections into the segregated network using parameters supplied in the incoming POST requests. The chain meant the restricted network could be reached via ordinary HTTP traffic, with no standing connection between the public internet and the isolated segment.

Once inside, the group shifted toward durable persistence. Legitimate pam_unix.so modules were swapped for backdoored versions that both accepted hardcoded passwords and captured credentials as legitimate users authenticated. Sygnia identified nine distinct compiled variants of the malicious module, with two functionally separate types — one acting purely as a backdoor and the other focused on credential harvesting — pointing to separate build environments and considerable resourcing. SSH binaries, including ssh, sshd, and scp, were replaced with trojanized counterparts that logged commands and exfiltrated session data for later retrieval.

With PAM and OpenSSH under attacker control, every administrative login and command across affected hosts was visible to Velvet Ant. Credential changes by defenders provided no relief because the attackers intercepted credentials at the point of use rather than relying on stored secrets tied to a single foothold.

Remediation proved as complex as the intrusion itself. So many core binaries had been replaced that removing them without first validating substitutes risked locking administrators out or triggering operational failures. Sygnia constructed a dedicated test laboratory to profile each host, validate replacement binaries, and prepare rollback procedures before touching production systems.

The operation underscores that network segmentation, while valuable, does not substitute for integrity controls on the software handling authentication. An isolated network whose authentication stack has been replaced effectively grants persistent, credential-independent access to whoever controls those components.