CERT24China-linked hackers planted a backdoor in Linux login software for nearly a decadeLoading data…
CERT24Threat Observatory
Period

China-linked hackers planted a backdoor in Linux login software for nearly a decade

According to Sygnia, the China-linked group Velvet Ant backdoored Linux PAM and OpenSSH components to remain hidden in systems. The attackers modified trusted login programs, enabling access with a secret password and recording usernames, passwords, and commands. The earliest traces date to 2016.

← Back to intelligence

China-linked hackers planted a backdoor in Linux login software for nearly a decade

According to Sygnia, the China-linked group Velvet Ant backdoored Linux PAM and OpenSSH components to remain hidden in systems. The attackers modified trusted login programs, enabling access with a secret password and recording usernames, passwords, and commands. The earliest traces date to 2016.