China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

Summary: Sygnia reports that a China-nexus group it tracks as Velvet Ant backdoored the PAM and OpenSSH login components on a network with no direct internet access, with the earliest traces going back to 2016. The attacker replaced the main PAM login module with backdoored copies across nine separate versions, some admitting a secret password and others recording real usernames and passwords, and altered OpenSSH to log credentials and every command typed with a hidden switch to disable logging.
What you should know: Password resets and killed sessions do not help when the component checking those credentials is working for the attacker, and a wrong replacement during cleanup can lock admins out of a live system. The same group turned internet-exposed F5 BIG-IP appliances into internal command servers in 2024 and used CVE-2024-20399 on Cisco NX-OS switches, which Cisco patched in July 2024 and CISA flagged as exploited the next day.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2024-20399
Related: CVE-2024-20399: Cisco NX-OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jul 02, 2024
ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026