Velvet Ant - Backdoored PAM Module Loading (T1556.003)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Identifies authentication binaries (sshd, su, sudo) loading a pam_unix.so module that contains anomalous compile-time RPATHs pointing to the attacker's staging directories, as observed in the Velvet Ant campaign.