Velvet Ant Lived Inside PAM and OpenSSH for Nearly Ten Years

If you wanted to stay inside a network for the better part of a decade, where would you hide?

Not on the laptops. Not on the servers anyone bothers to image. You'd hide in the thing every other box has to talk to before it lets a human in.

That is roughly what Velvet Ant did. The China-nexus group, tracked by Sygnia, planted backdoors directly inside Pluggable Authentication Modules (PAM) and OpenSSH on a victim network and sat there for close to ten years. The implants lived in the components that decide who gets a shell, which is also the layer most incident-response playbooks treat as part of the operating system itself and quietly trust.

This is the auth-layer version of an old web-security move. Backdooring login is the on-prem cousin of a malicious WordPress auth plugin, or a tampered PAM module on a jump host — same idea, just closer to the kernel and further from the EDR console.

PAM is the obvious target. It is the abstraction Linux distros use to glue sshd, sudo, su, screen lockers and console logins to whatever auth backend the box happens to use. Drop a rogue .so into /lib/security/ or quietly modify an existing one, wire it into /etc/pam.d/sshd, and every successful login flows through your code. Add a magic password or a static key check and you have a parallel auth path nobody is logging.

The OpenSSH side is the same logic one layer up. A modified sshd binary, or a patched library it links against, can accept an attacker key, skip audit hooks, or silently whitelist a source IP. Researchers have been documenting trojanized OpenSSH builds for years. What is interesting here is the dwell time, not the novelty.

A few things make this kind of access very sticky.

Golden images and config management often redeploy the compromised binaries, because the bad versions are what got baked in. Reboots do nothing. Credential rotation does nothing — the backdoor does not need credentials. Even rebuilding a host from "known good" packages fails if known-good was poisoned years ago.

Detection is unglamorous but tractable. Hash every pam_*.so against the distro package. Diff sshd and its linked libraries against the upstream binary for that exact version. Watch for PAM modules loaded from paths outside the package manager's manifest. Alert when sshd spawns children that are not a shell or SFTP subsystem.

The broader lesson is one defenders keep relearning. Identity is infrastructure. The code that answers "is this person allowed in" deserves the same supply-chain paranoia we now apply to CI pipelines and container base images.

Velvet Ant just demonstrated the upside of that paranoia, in years.