threat-intel
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Summary
A China-linked threat actor, identified as Velvet Ant, has been discovered backdooring Linux login software for nearly a decade, gaining persistent access to a network with no direct internet connectivity. The group’s tactic involved modifying core system components like PAM and OpenSSH to silently record user credentials and commands. This highlights the importance of securing critical infrastructure components that are often overlooked in security monitoring.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data