Executive Summary
In 2026, cybersecurity researchers uncovered 'Operation Highland,' a decade-long cyber-espionage campaign by the Chinese state-sponsored group Velvet Ant. Beginning in 2016, the attackers initially compromised internet-facing servers, deploying modified GS-Netcat reverse shells for encrypted remote access. They then installed custom SOCKS5 proxies to tunnel traffic, enabling access to isolated networks. By backdooring Linux Pluggable Authentication Modules (PAM) and OpenSSH components, Velvet Ant harvested credentials and maintained persistent access, effectively embedding themselves within the authentication process. This allowed them to monitor administrative activities and exfiltrate sensitive data undetected for ten years.
The discovery of this prolonged intrusion underscores the evolving sophistication of state-sponsored cyber threats. It highlights the critical need for organizations to implement robust monitoring of authentication systems, conduct regular integrity checks of security components, and adopt a zero-trust security model to mitigate the risk of such stealthy and persistent attacks.
Why This Matters Now
The revelation of Operation Highland emphasizes the urgent need for organizations to reassess and fortify their cybersecurity defenses, particularly focusing on authentication mechanisms and the integrity of security components. As state-sponsored cyber threats become more sophisticated and persistent, adopting a zero-trust security model and implementing continuous monitoring are essential to detect and prevent such long-term intrusions.
Attack Path Analysis
Velvet Ant initiated the attack by exploiting vulnerabilities in internet-facing servers to gain initial access. They escalated privileges by deploying backdoored authentication modules, allowing persistent access. Utilizing custom SOCKS5 proxies, they moved laterally to reach isolated network segments. Command and control were maintained through modified Nginx configurations, enabling remote execution via HTTP requests. Exfiltration was achieved by capturing and storing credentials and administrative activities for future retrieval. The impact included long-term surveillance and data theft over a decade.
Kill Chain Progression
Initial Compromise
Description
Velvet Ant exploited vulnerabilities in internet-facing servers to gain initial access.
Related CVEs
CVE-2023-46747
CVSS 9.8An unauthenticated attacker with network access to the F5 BIG-IP system through the management port and/or self IP addresses can execute arbitrary system commands due to a flaw in the configuration utility that bypasses authentication measures.
Affected Products:
F5 BIG-IP – 13.1.5 through 17.1.0
Exploit Status:
exploited in the wildCVE-2024-20399
CVSS 6.7A vulnerability in the Cisco NX-OS software could allow an authenticated, local attacker to execute arbitrary code with root privileges due to improper input validation.
Affected Products:
Cisco NX-OS – various versions
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Hijack Execution Flow
Modify Authentication Process: Pluggable Authentication Modules
Modify Authentication Process: Multi-Factor Authentication
Valid Accounts
Proxy
Application Layer Protocol
OS Credential Dumping
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Secure Authentication Mechanisms
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity and Access Management
Control ID: Identity and Access Management
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
Critical infrastructure isolation bypassed through authentication hijacking; PAM/SSH compromise enables decade-long espionage with full administrative visibility and persistence.
Telecommunications
Network segmentation vulnerabilities exposed; encrypted traffic interception and lateral movement through compromised authentication stacks threaten service provider infrastructure.
Government Administration
Air-gapped network penetration demonstrates advanced persistent threat capabilities; compromised authentication modules provide unrestricted access to classified systems.
Financial Services
Zero trust segmentation failures enable credential harvesting; east-west traffic compromise and egress security bypass threaten regulatory compliance requirements.
Sources
- Chinese hackers hijack auth flow, spy on isolated network for a decadehttps://www.bleepingcomputer.com/news/security/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade/Verified
- Cisco patches actively exploited zero-day flaw in Nexus switcheshttps://www.csoonline.com/article/2512990/cisco-patches-actively-exploited-zero-day-flaw-in-nexus-switches.htmlVerified
- China-linked group exploited legacy F5 BigIP appliances for 3 yearshttps://www.scworld.com/news/china-linked-group-exploited-legacy-f5-bigip-appliances-for-3-yearsVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's lateral movement and data exfiltration, thereby reducing the overall blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit vulnerabilities in internet-facing servers may have been limited, reducing the likelihood of initial access.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges through backdoored authentication modules could have been constrained, reducing the scope of unauthorized access.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement through custom SOCKS5 proxies could have been limited, reducing their ability to access isolated network segments.
Control: Multicloud Visibility & Control
Mitigation: The attacker's command and control channels via modified Nginx configurations could have been constrained, reducing their ability to maintain remote execution.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate captured credentials and administrative data could have been limited, reducing the risk of data theft.
The attacker's prolonged surveillance and data theft activities could have been constrained, reducing the overall impact of the breach.
Impact at a Glance
Affected Business Functions
- Network Security
- Authentication Services
- System Administration
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of administrative credentials and sensitive network configurations.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement and limit access to critical systems.
- • Deploy East-West Traffic Security controls to monitor and control internal network communications.
- • Utilize Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Establish Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Apply Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
