Velvet Ant - Hidden OpenSSH Keylogger Artifacts (T1056.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Hunts for the creation of hidden keylogger output files formatted with MD5 hashes (s<MD5> or c<MD5>) within the deceptive /usr/share/man9/ph/ directory, as observed in Velvet Ant activity.