Velvet Ant SOCKS5 Proxy Masquerading as smbd from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects an attacker-controlled SOCKS5 proxy masquerading as the Samba daemon (smbd) by renaming the process to 'smbd' and executing it with the '-D' flag from non-standard filesystem locations such as /tmp, /home, /var/tmp, or /dev/shm. This behavior is associated with the Velvet Ant threat group, which uses this technique to maintain persistent command-and-control communication while evading detection by blending in with legitimate system processes.