Velvet Ant Atlas RAT - Non-Standard Path Service Beaconing + Systemd Unit File Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Linux processes running from non-standard directories that exhibit network beaconing behavior, correlated with the concurrent creation or modification of systemd unit files on the same host. This pattern is indicative of a remote access trojan (RAT) or backdoor establishing persistent command-and-control.