Velvet Ant 'uptime' Binary Masquerading on Linux (Operation Highland)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of the Linux uptime utility, either as a standalone process or via common web server parent processes (nginx, httpd, apache), particularly when associated with suspicious command-line arguments or network activity. This behavior is often associated with reconnaissance or post-exploitation activities.