Velvet Ant OpenSSH Binary Replacement Outside Package Manager on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.