Operation Highland: authentication as the gateway to a decade of persistence

The technical details Sygnia published about what they called "Operation Highland" are a clear warning: an isolated network can be penetrated and controlled in the long term if the opponent compromises the authentication layer. According to the researchers, the actor known as Velvet Ant was able to start access from Internet-exposed systems, pivote to internal servers, and finally be embedded in the very process that validates identities in the compromised hosts.

The campaign, which would have started in 2016 and remained for a decade, did not conform to simple implants: the attackers built a remote execution chain that went through reverse proxies and Nginx modifications to convert HTTP requests into orders that triggered SSH connections to "air-gapped" environments. This approach shows that the absence of a direct Internet route does not guarantee isolation when there are pass servers and manipulative configurations.

More disturbing is the strategy to override authentication: operators replaced PAM and OpenSSH's critical binary libraries with stranded versions that accepted clear credentials, recorded commands and exfiltered data. In practice, that transforms any password reboot or session termination into a cosmetic patch, because the silent door is already integrated into the mechanism that allows access.

The technical lesson is simple but deep: authentication is not just another part of the attack surface, it is the most sensitive asset of an infrastructure. Therefore, in addition to perimeter controls, organizations should apply detection and protection focused on modules and binaries that affect the login, validate signatures and source of packages and audit any changes in services such as PAM and OpenSSH. The official OpenSSH page is a reference point for understanding how that software works and what deployment practices are recommended: OpenSSH.

From the detection perspective, there are practical indicators that deserve attention: unplanned changes in configuration files (e.g. Nginx), the emergence of FastCGI processes listening in atypical ports, SOCKS5 proxies that are disguised as legitimate services and persistent outgoing connections to retransmission domains. File integrity monitoring, process command line analysis and DNS / EGRESS visibility are controls that can interrupt such an escalation.

The disassembly of this intrusion illustrates another operational risk: when attackers replace authentication components, cleaning can leave legitimate administrators out of service and cause serious operational interruptions. Therefore, responsible remediation requires test environments that simulate the real status of hosts, rollback procedures and offline and immutable backup. Sygnia's experience emphasizes that unprepared restoration may be worse than keeping the commitment temporarily contained.

In terms of mitigation, it is essential to take measures that go beyond classical detection. EDR with integrity control, strict privileged access policies, function separation and robust multifactor authentication are fundamental parts, but so is recovery capacity: immutable snapshots, verified recovery plans and recovery environments with verified system images. In addition, limiting the output routes from exposed servers and applying white running lists reduces the likelihood that a custom implant will be established as persistence.

The case also requires a review of the confidence model within the network. If a host acting as a "backend" or a proxy can transform an HTTP request into command execution, logical segmentation and configuration validation should prevent a Nginx or FastCGI modification from opening a channel to critical systems. In this sense, it is useful to combine network controls (microsegmentation, egress filtering) with endpoints controls and continuous audit.

For teams that manage critical infrastructure, it is appropriate to integrate these learning in practical exercises: authentication chain-oriented intrusion tests, restoration simulations from immutable backups and regular reviews of libraries and binaries involved in the start-up. The original technical reports, such as Sygnia's, provide traces and techniques that can be contrasted against own telemetry to detect similar patterns; the complete analysis can be found in the public report: Sygnia - Operation Highland.

Ultimately, the history of Operation Highland is not just a succession of tools and exploits: it is a reminder that the most dangerous persistence does not need to remain hidden in exotic binaries, but to be integrated into what the system uses to decide who enters. Protecting that decision is, today, a strategic priority for any organization that does not want to spend years being observed from within.