Velvet Ant Masquerading System Utilities Executing from Non-Standard Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.