Velvet Ant Trojanized OpenSSH Binary Replacement (sshd/ssh/scp)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects when the SSH daemon or associated client binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) are overwritten or newly created on a Linux system. This is a highly suspicious activity often associated with rootkits, backdoors, or persistence mechanisms aimed at intercepting credentials or maintaining unauthorized remote access.