Velvet Ant fcgiwrap Spawning System Utility from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.