Velvet Ant Operation Highland - Nginx Config Modification by Non-Nginx Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized modifications to Nginx configuration files by processes other than the Nginx service itself, known package managers, or common configuration management tools. This behavior is indicative of potential malicious activity, such as the injection of proxy directives (e.g., fastcgi_pass, proxy_pass) as observed in the Velvet Ant Operation Highland, used to pivot traffic into protected or air-gapped network segments.