Velvet Ant - Malicious 'uptime' Binary Masquerading as Linux System Utility

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.