
Velvet Ant spent 10 years inside an air-gapped network by trojaning Linux authentication
Chinese cyberespionage group Velvet Ant compromised an isolated critical infrastructure network in 2016 and remained undetected for a decade — by replacing Linux PAM and OpenSSH binaries with backdoored versions that embedded persistent access into the authentication process itself.










