Velvet Ant’s Operation Highland: A Decade Inside Critical Infrastructure

Operation Highland is a detailed incident report of a China-linked APT called Velvet Ant that remained stealthily embedded in a victim network for nearly a decade, ultimately reaching segregated critical infrastructure. The actors used multi-stage access chains (internet-facing persistence, lateral movement, HTTP-to-SSH bridging via compromised web servers), exploited vulnerabilities including a Cisco NX-OS zero-day, deployed custom backdoors (VELVETSHELL), trojanized PAM and OpenSSH binaries to capture credentials and maintain persistence, and employed high operational security to avoid detection; the report highlights the difficulty of remediation and recommends treating authentication components as critical assets.