hacker-news Jul 10, 2026 · Crawled Jul 10, 2026

New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

1 Actors 3 Malware

AI Summary

The China-linked threat actor Silver Fox has been linked to a new Rust-based remote access trojan (RAT) named MODBEACON. This malware leverages gRPC streaming and reuses transport layers from the open-source Xray/V2Ray framework for encrypted command-and-control (C2) communications. It targets technology, education, and state-owned enterprises in Asia via counterfeit software installers distributed through SEO poisoning, enabling long-term access with capabilities including plugin loading, persistence, and data exfiltration.

AI-extracted · verify before operational use

Extracted Entities 4 found

Threat Actor Void Arachne → Malware Ghost RAT → Malware Winos → Malware ValleyRAT →

MITRE ATT&CK TTPs 34 techniques

T1005 Data from Local System · Collection T1006 Direct Volume Access · Defense Evasion T1012 Query Registry · Discovery T1014 Rootkit · Defense Evasion T1021 Remote Services · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1053.003 Cron · Execution T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.012 Process Hollowing · Defense Evasion T1055.015 ListPlanting · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.003 Clear Command History · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1085 T1085 T1090 Proxy · Command And Control T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1204.002 Malicious File · Execution T1213 Data from Information Repositories · Collection T1213.001 Confluence · Collection T1543.001 Launch Agent · Persistence T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1548.002 Bypass User Account Control · Privilege Escalation T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access