Velvet Ant Atlas RAT: uptime Masquerade Network C2 or AtlasRAT Binary on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.