Velvet Ant: SSH or uptime Spawned from Nginx/fcgiwrap Execution Bridge

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious execution of 'ssh', 'sshd', or 'uptime' binaries initiated by web server processes like 'nginx', 'fcgiwrap', or 'uptime'. This behavior often indicates exploitation of a web application to gain remote access or execute unauthorized system commands.