TLDR Tech / InfoSec
Chinese Hackers Hijacked Auth Flow, Spy On Isolated Network for a Decade
Sygnia researchers reported that the Chinese Velvet Ant APT breached a critical infrastructure network for 10 years. The APT breached an internet-facing server, deployed a modified GS-Netcat reverse shell, and set up a SOCKS5 proxy to tunnel to air-gapped systems. It also modified an internet-facing Nginx proxy to forward requests to internal systems by establishing SSH connections via HTTP POST request parameters. Recovery from the breach was particularly complex because the attackers replaced many legitimate tools, such as pam_unix and ssh tools, with trojanized versions.
Read the full story