China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

Velvet Ant, a China-nexus threat actor, covertly backdoored Linux login components (PAM and OpenSSH) since 2016 to log credentials and commands and maintain persistent access to isolated networks by staging through internet-facing systems; the group has also abused F5 and Cisco infrastructure. The report recommends integrity monitoring of login binaries, comparing against known-good copies, removing backdoors prior to password resets, patching relevant CVEs (including CVE-2024-20399), and testing replacements in a lab to avoid administrator lockout.