RST TI Report Digest: 15 Jun 2026

Sygnia’s investigation of Operation Highland attributes a decade-long, highly sophisticated intrusion in a critical infrastructure environment to a China-nexus actor dubbed Velvet Ant. The actor initially compromised Internet-facing systems, pivoted into an isolated operational network, backdoored authentication components (multiple pam_unix.so variants and modified OpenSSH binaries) to capture credentials, bypass logging, and persist despite password changes, and deployed custom tools including a modified GS-Netcat reverse shell and an Nginx/FastCGI execution bridge; the report includes extensive IOCs (IPs, domains, and many file hashes).