Velvet Ant Operation Highland Nginx-FastCGI Network Pivot to Air-Gapped Segment

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.