The threat, dubbed Operation Highland, involved the Velvet Ant cyberespionage group compromising internet-facing servers and establishing a remote execution path into an isolated critical infrastructure network without direct internet connectivity. They used a modified GS-Netcat reverse shell and a custom SOCKS5 proxy for internal pivoting. By altering Nginx configurations and leveraging a FastCGI wrapper, they executed commands inside the segregated environment. The attackers replaced legitimate Linux PAM modules and OpenSSH components with trojanized versions that accepted hardcoded passwords, harvested credentials, logged SSH commands, and stored data locally. This manipulation of the authentication stack allowed persistent access and full observability of administrative actions over a ten-year period. Cleanup is difficult due to the deep integration of malicious components into authentication processes.

The attackers gained persistent, undetectable access to an isolated critical infrastructure network for ten years, with full visibility into all administrative logins and commands. They could bypass authentication controls and maintain access despite password changes and session terminations. This compromises the confidentiality and integrity of administrative credentials and activities, severely undermining network security and operational trust. The complexity of the compromise makes remediation challenging and risks operational outages if not carefully managed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Sygnia researchers recommend treating authentication components such as PAM, OpenSSH, and Windows LSASS as critical security assets. Defenders should protect these with endpoint detection and response (EDR), file integrity monitoring, hardened privileged access, multi-factor authentication (MFA), and continuous monitoring for unauthorized modifications. Organizations should plan for offline recovery with strict, immutable backups and test restoration procedures thoroughly before attempting cleanup. Due to the complexity of the compromise, remediation requires validated rollback procedures and testing in isolated environments to avoid operational disruptions.