Velvet Ant Operation Highland GS-Netcat / Trojanized uptime Implant

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects execution of GS-Netcat covert C2 tunnels or masqueraded 'uptime' binaries running from non-standard system paths, consistent with persistent implants used by the Velvet Ant threat actor in Operation Highland.