Velvet Ant Operation Highland - Backdoored SSH PAM Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential indicators of an SSH/PAM backdoor. This includes three behaviors: 1) SSH-related system processes writing to suspicious file paths (e.g., /tmp, /dev/shm, or hidden files in user directories), 2) PAM sessions immediately followed by suspicious file writes, and 3) successful SSH authentications for usernames previously reported as 'Invalid' by the system, suggesting a tampered PAM module allowing arbitrary authentication.