New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic
Summary: QiAnXin attributed a new Rust-based remote access trojan called MODBEACON to the China-linked group Silver Fox, which distributes malware through counterfeit software installers pushed via SEO poisoning campaigns. The memory-resident implant fetches additional modules, runs operator commands, and uses gRPC tunnel streaming for encrypted command-and-control, reusing the transport layer of the open-source Xray/V2Ray anti-censorship proxy framework, with C2 infrastructure hosted on Amazon and Cloudflare's CDN.
Why it matters: A distributor QiAnXin describes as a hybrid of 'cybercriminal arms dealer' and 'traffic broker' is renting high-value access to downstream customers and running criminal-on-criminal schemes against the Cambodian gambling sector, so the same intrusion that lands in your environment may be sold onward rather than used in place.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026