#3
The Hacker News
general
June 12, 2026 at 18:17 UTC
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
By [email protected] (The Hacker News)
AI Summary
Sygnia researchers revealed that China-nexus threat group Velvet Ant spent nearly a decade hidden inside a targeted network by backdooring Linux PAM and OpenSSH authentication components — the very mechanisms used to control login access. This persistence technique survived standard incident response cleanup efforts, underscoring the danger of compromising authentication infrastructure rather than user-space applications. Security teams should audit PAM and SSH configurations for unauthorized modifications as part of threat hunting activities.
Relevance score: 90.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →