Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected

Velvet Ant, a China-linked threat actor, maintained nearly a decade of undetected access to a highly isolated internal network by deeply compromising authentication layers—replacing PAM modules and OpenSSH binaries—to embed stealthy, resilient persistence that evaded conventional detection and rendered remediation both technically and operationally perilous.