Chinese APT Velvet Ant Maintained Decade-Long Espionage Access to Critical Infrastructure via Hijacked Authentication Stack

Analysis
Nine separately compiled pam_unix.so variants and a custom SSH flag suppressing the actor's own session logging indicate a per-target build pipeline refined over years. The authentication layer is recast as an adversarial attack surface requiring integrity monitoring on par with EDR coverage. That conclusion rests on Sygnia's direct incident response reporting without independent forensic corroboration from secondary sources. The target's air-gap status is an organizational assertion; absent independent verification of that isolation, the technical achievement attributed to Velvet Ant softens materially. Formal public attribution by a U.S. or allied government to a named Chinese state entity is unlikely within six months. Confidence is moderate: the sparse historical record of government attribution against China-nexus actors, even when the technical case is strong, constrains that ceiling, and absent official attribution, sector-wide authentication integrity audits remain discretionary rather than compelled.