Threat Intel

China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

Enterprise Linux infrastructure faces heightened APT risk as authentication bypass techniques target core system components rather than traditional endpoints.

Summary written by editorial AI · Source link below

Filed by THN (Feedburner)12 June 20261 min readRead at source ↗

Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself.

Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it. The network it targeted had no

Editorial Analysis

Why it matters

This demonstrates how APT groups are evolving to target foundational infrastructure components that security teams typically trust implicitly. Organizations need to reassess monitoring coverage of authentication systems.

What to do

Audit PAM and OpenSSH configurations for unauthorized modifications and implement integrity monitoring on authentication components.

Board brief

Nation-state actors are compromising the foundation of enterprise Linux systems, requiring immediate infrastructure security review.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at THN (Feedburner)

External link — opens at THN (Feedburner) in a new tab.

Continue with

Editorial Analysis

More from the Threat Intel Desk