The recent revelations about the Velvet Ant hacking group's activities have shed light on a sophisticated and long-running cyber intrusion. This case study, as analyzed by Sygnia, serves as a stark reminder of the evolving nature of cyber threats and the need for a proactive and adaptive security approach.
Unveiling a Stealthy Intrusion
What makes this particular breach fascinating is the attackers' ability to remain undetected for an astonishingly long period, dating back to 2016. Velvet Ant, a China-nexus threat actor, embedded itself deep within the targeted organization's network, exploiting vulnerabilities and manipulating core system components.
The group's strategy involved replacing key PAM modules and OpenSSH binaries with altered versions, creating a backdoor for continued access and enabling credential theft. This approach, which I find particularly intriguing, highlights the attackers' understanding of the target environment and their ability to mimic legitimate administrative tools, thus evading conventional detection methods.
A Complex Attack Path
The intrusion unfolded in a series of well-planned stages. Initially, the attackers gained access to internet-facing systems using modified networking tools and a custom proxy. From there, they exploited Nginx and FastCGI on compromised web servers to establish a remote execution path into the critical infrastructure network. This allowed them to bypass direct internet connectivity and obtain sensitive data.
One detail that immediately stands out is the use of a custom binary named "uptime" to open SSH connections and run scripts on target devices. This demonstrates a high level of technical sophistication and a deep understanding of the target environment's architecture.
Compromising the Authentication Layer
The central finding, in my opinion, is the manipulation of PAM and OpenSSH components. The attackers created multiple malicious variants of pam_unix.so, each linked to different build environments, indicating a deliberate and well-resourced operation. Some variants accepted hardcoded backdoor passwords, while others harvested legitimate user credentials, showcasing the attackers' ability to adapt their methods.
The modified OpenSSH components captured login credentials and logged shell commands, providing the attackers with persistent access and the ability to disable security measures. The presence of older and newer variants suggests a long-term presence and the attackers' willingness to adapt their tools over time.
The Challenge of Remediation
Remediating this breach was particularly challenging due to the attackers' compromise of the authentication layer, which administrators rely on to manage production systems. Replacing malicious services is often straightforward, but in this case, it carried the risk of locking out defenders or causing operational disruptions.
The affected network segment's lack of internet connectivity further complicated the situation, as defenders couldn't easily access trusted repositories or resolve dependencies. Sygnia's approach, which involved building a lab to test the recovery process and profiling each machine, showcases the importance of thorough planning and preparation in such complex scenarios.
Broader Implications
This case highlights the limitations of signature-based detection and alert-driven security operations when faced with sophisticated attackers. The ability of the Velvet Ant group to alter trusted system components rather than deploy obviously malicious files underscores the need for continuous monitoring and inspection of authentication infrastructure, especially in high-sensitivity environments.
In my view, this breach serves as a wake-up call for organizations to adopt a more proactive and adaptive security posture, constantly evolving their defenses to stay ahead of persistent and resourceful threat actors.
