The China-linked threat actor Velvet Ant maintained persistent, stealthy access to a target network for nearly a decade by compromising the organization's full authentication stack, a method that made their removal exceptionally difficult. The article does not provide specific technical details on the initial attack vector, nor does it mention a CVE, CVSS score, affected software versions, patches, or workarounds.
A China-linked cyber espionage group known as Velvet Ant spent nearly a decade inside the internal network of an unnamed organization without being detected, according to the results of a forensic investigation published by cybersecurity firm Sygnia. The group’s defining characteristic is the ability to maintain stealthy years-long persistence in target environments. In this particular case, booting them out also took considerable effort, as they managed to gain control of the full authentication stack by … More → The post China-linked spies backdoored authentication stack to stay hidden for years appeared first on Help Net Security .