Velvet Ant Hackers Backdoor OpenSSH and PAM to Spy on Critical Infrastructure Network

**Operation Highland (Velvet Ant):** A near-decade, highly disciplined intrusion in which a China-linked APT replaced core authentication components (backdoored pam_unix.so variants and modified OpenSSH binaries), deployed custom C2 (modified GS‑Netcat, SOCKS5 proxy), and abused web/FastCGI to pivot into segmented critical-infrastructure hosts; the report highlights credential exfiltration, persistent access that survives normal containment, and complex remediation steps (per-host testing, golden recovery hosts, vaulting credentials) to safely restore affected environments.