Actor Profile

Velvet Ant (G1047) is a China-linked advanced persistent threat actor characterized by exceptional operational security and long-term persistence capabilities. The group demonstrates sophisticated understanding of Linux authentication infrastructure, specifically targeting PAM (Pluggable Authentication Modules) and OpenSSH components to establish covert, durable access. Their operational tradecraft reflects a strategic focus on maintaining undetected presence within critical authentication layers, enabling persistent access that survives standard incident response and system hardening procedures. The group is known to deploy PlugX malware and exhibits patience consistent with state-sponsored intelligence collection objectives.

TTPs (Tactics, Techniques, Procedures)

Velvet Ant employs a diverse set of techniques spanning initial access, persistence, defense evasion, and lateral movement. Key TTPs include: T1133 (External Remote Services) for initial access; T1574.001 (DLL Search Order Hijacking) and T1037.004 (RC Scripts) for persistence; T1090.001 (Internal Proxy) and T1571 (Non-Standard Port) for command and control; T1132 (Data Encoding) and T1573.002 (Asymmetric Cryptography) for obfuscation; T1047 (Windows Management Instrumentation) and T1059.004 (Unix Shell) for execution; T1570 (Lateral Tool Transfer) for lateral movement; and T1040 (Network Sniffing), T1083 (File and Directory Discovery), T1049 (System Network Connections Discovery), and T1686 (Container Administration Command) for discovery and reconnaissance. T1569.002 (Service Execution) supports both execution and persistence objectives.

Targets & Patterns

While specific targeted sectors are not detailed in available reporting, Velvet Ant's focus on Linux authentication infrastructure suggests targeting of organizations heavily reliant on Unix/Linux environments—likely including technology companies, cloud service providers, telecommunications firms, and research institutions. The nearly decade-long persistence window indicates targeting of high-value networks where long-term intelligence collection justifies the operational investment. The choice to backdoor PAM and OpenSSH—ubiquitous authentication mechanisms—demonstrates intent to compromise environments where these systems serve as critical gatekeepers, enabling the actor to intercept credentials, monitor authentication events, and maintain access even through infrastructure refreshes and security audits.

Historical Context

Velvet Ant's operational timeline spans nearly a decade, representing one of the longest documented persistence campaigns against Linux authentication infrastructure. This extended dwell time places the activity among elite APT operations characterized by extreme patience and stealth. The group's use of PlugX malware connects them to a broader ecosystem of China-nexus threat actors who have deployed this modular RAT since at least 2012. The focus on authentication layer compromise echoes tactics observed in other sophisticated campaigns targeting critical infrastructure and supply chain elements, where access to authentication systems provides both immediate operational value and long-term strategic positioning for future operations.

Defensive Recommendations

  • Implement file integrity monitoring (FIM) on critical authentication binaries including PAM modules (/lib/security/, /lib64/security/) and OpenSSH components (/usr/sbin/sshd, /etc/ssh/), alerting on any unauthorized modifications (MITRE D3-IAA)
  • Detect T1574.001 (DLL Search Order Hijacking) and T1037.004 (RC Scripts) by monitoring for unexpected library loads via LD_PRELOAD, LD_LIBRARY_PATH modifications, and unauthorized entries in /etc/rc.local or systemd service files
  • Hunt for T1571 (Non-Standard Port) and T1090.001 (Internal Proxy) by baselining normal network behavior and flagging unexpected outbound connections from authentication services, particularly on non-standard ports
  • Detect T1040 (Network Sniffing) by monitoring for processes with CAP_NET_RAW capabilities or use of packet capture tools (tcpdump, libpcap) on production authentication servers where such activity is not operationally justified
  • Conduct regular cryptographic verification of critical system binaries against known-good hashes from trusted repositories, and deploy endpoint detection capable of identifying T1573.002 (Asymmetric Cryptography) anomalies in authentication traffic patterns

---

# Geopolitical Context

Geopolitical Context

The compromise of Pluggable Authentication Modules (PAM) and OpenSSH components represents a sophisticated supply chain and persistence strategy consistent with advanced persistent threat (APT) operations attributed to China-linked actors. By targeting foundational authentication infrastructure rather than application-layer vulnerabilities, Velvet Ant demonstrates operational maturity and long-term strategic patience characteristic of state-sponsored cyber espionage. The nearly decade-long persistence window suggests intelligence collection priorities focused on sustained access rather than disruptive operations, aligning with broader patterns of Chinese cyber activity emphasizing long-term strategic advantage in critical infrastructure and enterprise environments. The targeting of Linux systems—prevalent in cloud infrastructure, telecommunications, and enterprise server environments—indicates potential interest in high-value networks where these systems serve as authentication gateways.

State Actor Alignment

Velvet Ant is assessed to be linked to Chinese state interests based on operational patterns and targeting. The group's capability to maintain undetected access in authentication systems for nearly a decade suggests access to significant resources and operational security discipline consistent with state-sponsored actors. While specific attribution to Chinese government entities has not been publicly detailed in this reporting, the "China-linked" designation and the strategic nature of the compromise align with known Chinese APT operational priorities, including long-term intelligence collection and strategic positioning within critical infrastructure. Organizations in sectors of strategic interest to Beijing—including technology, telecommunications, defense industrial base, and government networks—should consider themselves at elevated risk.

Business Impacty pro region

The compromise has global implications given the ubiquity of Linux systems in enterprise, cloud, and critical infrastructure environments across all regions. European organizations, particularly those in telecommunications, energy, and technology sectors, face elevated risk given documented Chinese APT interest in European critical infrastructure and intellectual property. NATO member states and Five Eyes partners may be priority targets given strategic intelligence value. The authentication-layer compromise technique poses particular risk to managed service providers and cloud infrastructure operators, where a single compromise could provide access to multiple downstream customers. Developing economies increasingly reliant on Linux-based infrastructure for digital transformation initiatives may face disproportionate risk if security resources are limited. The incident underscores the challenge of detecting and remediating supply chain and firmware-level compromises that evade traditional endpoint security controls.

Forecast

If Velvet Ant's techniques become more widely adopted by other APT groups, defenders will likely need to prioritize integrity monitoring of authentication components and implement zero-trust architectures that assume endpoint compromise. Organizations that have not conducted forensic audits of PAM and OpenSSH configurations in recent years should anticipate potential undetected compromise and may need to undertake resource-intensive remediation efforts. If geopolitical tensions between China and Western nations continue to escalate, particularly around technology supply chains and critical infrastructure security, regulatory pressure for enhanced authentication security and supply chain transparency is likely to increase. Vendors of Linux distributions and open-source maintainers may face growing pressure to implement code-signing and integrity verification mechanisms for core authentication components. In the near term, incident response teams should expect increased scrutiny of authentication logs and PAM module configurations as organizations assess potential exposure to this threat vector.