AI Autopsy: Could a Decade-Long Breach Be a Sign of Things to Come?

No organisation can boast of being 100% breach-proof. But ‘air-gapping’ sensitive assets remains the gold standard for critical infrastructure (CNI) providers. News that an APT group accessed a supposedly unreachable network for a decade should pique even the most jaded CISO’s interest. A new forensic report into “Operation Highland” details the work of a sophisticated, covert threat actor that relied on multiple layers of persistence embedded in the authentication stack itself.

Not many organisations will come across this level of ingenuity and tradecraft. But as AI democratises threat actor expertise, there’s a growing need to understand what those at the top of their game are up to.

Silent but deadly

Operation Highland is the work of China-nexus espionage group Velvet Ant, according to security vendor Sygnia, which discovered the breach. Its write-up describes three key stages of the attack: establishing persistent access on internet-facing systems; pivoting to the isolated critical infrastructure segment; and subverting the authentication stack for long-term persistence.

First, the APT group deployed a modified version of the publicly available GS-Netcat networking tool on internet-facing servers to establish a reverse shell connection to a remote C2 server. This enabled users to covertly tunnel traffic or execute commands remotely. Velvet Ant also deployed a network tunnelling tool for lateral movement. This allowed the group to route traffic silently through compromised hosts and reach internal systems not directly connected to the internet.

Next, the group moved into the segregated environment. Velvet Ant exploited an internet-facing Nginx server as another entry point, modifying it to proxy incoming requests to a compromised backend server. The latter was configured to forward requests to a FastCGI process listening on another port. It’s this FastCGI wrapper that acted as an “execution bridge”, processing requests and executing a binary named “uptime”. This custom tool was designed to establish an SSH connection to a server inside the air-gapped network, based on HTTP POST parameters sent in the request.

After establishing this remote-execution path into the air-gapped network, Velvet Ant shifted to long-term persistence focused on Linux Pluggable Authentication Modules (PAM). This suite of libraries allows admins to authenticate users. Velvet Ant replaced nine legitimate PAM modules with malicious modified versions across compromised hosts. These were designed to accept hardcoded backdoor passwords, harvest credentials from legitimate authentication attempts, or both, Sygnia said.

This approach offered advantages over relying on a simple compromised account, explains SANS Institute principal instructor, Xavier Mertens. “This meant that any service using the compromised module would automatically grant access to the threat actor. It also rendered major password change and credential rotation exercises ineffective,” he tells Assured Intelligence. “The backdoors generated virtually no noise and were largely indistinguishable from normal system operations.”

The group also replaced OpenSSH components ssh, sshd, and scp with trojanised versions designed for persistence, credential theft and network reconnaissance. These added an extra layer of persistence on top of the backdoored PAM modules. “Removing only one of these mechanisms would still leave the others intact,” says Mertens.

Air-gapping alone is not enough

Chen Tiktin, Sygnia incident response team leader, was heavily involved in the report.

“A key takeaway is that industry-standard signature-based detection and alert-driven security operations were not enough to protect against a threat actor that was both well-resourced and patient,” he tells Assured Intelligence. “There was no smoking-barrel, or a new exploit to catch. The attacker’s presence was indistinguishable from legitimate administrative activity.”

Security professionals should also see this campaign as a warning that segmentation alone isn’t sufficient to deter persistent intruders, adds SpecterOps CTO, Jared Atkinson. Rather than assume air gapping will do the trick, CISOs should deploy “disproportionate monitoring and validation” to these environments, he tells Assured Intelligence.

“The relevant question is not whether a system is directly connected to the internet, but whether an attack path exists that allows an attacker to eventually reach it,” Atkinson continues. “Attackers think in terms of reachability and navigation through systems, identities, and trust relationships. Defenders often think in terms of architectural diagrams and intended controls. Security gaps frequently emerge in the difference between those two perspectives.”

There are also lessons to be learnt about identity security.

“Attackers routinely collect credentials, but the real value comes from understanding what access those identities provide and how they can be used to navigate toward higher-value systems,” Atkinson says. “Defenders should take the same approach by continuously validating how identities, systems, and trust relationships interact across the environment and whether they create unintended attack paths to critical assets.”

Sygnia’s Tiktin is more prescriptive about what is required to mitigate similar threats in the future. “Treat PAM, OpenSSH, LSASS, and privileged access paths as critical security controls,” he suggests. “Hardening privileged access through methods such as vaulting credentials, disabling direct root SSH logins, and constantly evaluating local administrators to reduce attack surfaces can reduce the risk of unauthorised file changes.”

A remediation challenge

One of the biggest challenges facing the Sygnia team was not just removing the malware but eradicating Velvet Ant’s persistence without breaking the authentication system it had compromised. Replacing the PAM modules and OpenSSH binaries with the wrong package, an incompatible binary, or a missing dependency could have locked administrators out of a host.

“What CISOs should know about Operation Highland is that when the attacker controls the authentication layer, simply ‘deleting first and validate later’ is not enough and risks access cutoff or business disruption,” says Tiktin.

“Enterprises should prepare for offline recovery; creating regular copies of offline or immutable critical networks greatly assists in recovery efforts. These must be regularly tested, ensuring they can be deployed at a moment’s notice.”

A glimpse of the future?

The question is whether Operation Highland portends more pain for organisations in the future. As a likely state-backed campaign, it was well resourced and meticulously planned – as evidenced by the labour-intensive effort of backdooring nine PAM files, each built in a separate compile environment.

The bad news is that elements of Operation Highland may appear in future attacks, experts say.

“The technique of backdooring PAM and OpenSSH components is perhaps the most significant concern. While modifying the authentication stack may appear challenging, both PAM and OpenSSH are open source and widely deployed,” warns SANS’ Mertens. “We have already seen variations of this pattern in lower-tier ecosystems, where trojanised OpenSSH implementations have long been used by Linux cryptomining operations and IoT botnet groups.”

AI could also democratise certain elements of the attack, such as successfully modifying open-source authentication components, he says. RSA CISO Rob Hughes agrees, pointing to agentic AI.

“The reconnaissance, staging, and forensic countermeasure discipline that Velvet Ant maintained across 10 years required significant human effort. AI can compress that timeline and reduce the skill floor,” he tells Assured Intelligence.

“Critical infrastructure organisations are also deploying AI agents at a rate that outpaces their security governance. Each new agent is a non-human identity with privileged access, often with limited oversight. The attack surface that Velvet Ant exploited is growing, not shrinking.”

Black Kite CSO, Bob Maley, argues that Velvet Ant isn’t keeping him awake at night.

“It’s the mid-tier ransomware group that reads the Sygnia report, then adapts the PAM backdoor technique, and deploys it against healthcare infrastructure where Linux authentication components aren’t monitored, integrity isn’t verified, and the security team is triaging a SIEM that never fires,” he says.

“The gap between ‘nation-state exclusive’ and ‘widely available’ is closing faster than our detection architectures are maturing to meet it. That’s the actual risk here.”