Velvet Ant Operation Highland: Daemon Masquerade SOCKS5 Proxy on Non-Standard Paths/Ports

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.