MODBEACON RAT Uses gRPC Streaming C2, Deployed by Silver Fox via SEO-Poisoned Software Installers

Key facts for MODBEACON gRPC RAT

Detection coverage for MODBEACON gRPC RAT

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1181 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MODBEACON Trojanized Installer ZIP Execution Following Web Referral

Detects execution of a binary from a freshly-extracted ZIP archive shortly after browser download activity referencing a search-engine result, matching Silver Fox's SEO-poisoning delivery chain for counterfeit MODBEACON installers.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1608, T1189, T1204.002
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image)
| where like(img, "%\\downloads\\%") OR like(img, "%\\temp\\%")
| where match(CommandLine, "(?i)(install|setup|installer)") 
| join type=left ParentProcessId [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\explorer.exe" ]
| stats count min(_time) as first_seen by Computer, User, Image, CommandLine, ParentImage
| where count >= 1
| table first_seen, Computer, User, Image, CommandLine, ParentImage

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\AppData\\Local\\Temp\\")
| where ProcessCommandLine matches regex @"(?i)(install|setup|installer)"
| where InitiatingProcessFileName in~ ("explorer.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| summarize count() by DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine

Sigma

title: Suspicious Installer Execution From Download/Temp Path Post-Web-Referral
id: 8f1a2c3e-1a2b-4c3d-9e0f-a1b2c3d4e5f1
status: experimental
description: Detects execution of an installer-named binary from a Downloads or Temp folder, consistent with Silver Fox's SEO-poisoned counterfeit installer delivery for MODBEACON.
references:
    - https://thehackernews.com/2026/07/new-modbeacon-rat-uses-grpc-streaming.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-10
tags:
    - attack.reconnaissance
    - attack.t1608
    - attack.initial-access
    - attack.t1204.002
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\install.exe'
            - '\setup.exe'
        CommandLine|contains:
            - 'Downloads'
            - 'Temp'
    filter_legit:
        ParentImage|endswith:
            - '\msiexec.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate software installed manually from a browser download
level: medium

Known false positives:

• Legitimate manual installation of software downloaded via browser from a vendor site

Tuning notes: Restrict to newly-registered/typosquatted domains via proxy logs join if available; exclude known internal software-distribution installer paths and signed vendor installers.

• 🔒 Scheduled Task Masquerading as Routine Update Check · unlock with TL Creds
• 🔒 Reflective In-Memory Module Mapping Without Backing File (native-v3 Plugin Load) · unlock with TL Creds
• 🔒 Host Fingerprinting and Automated Collection Followed by Heartbeat Egress · unlock with TL Creds
• 🔒 gRPC/HTTP2-Shaped POST from Non-Browser Process to CDN-Fronted Host · unlock with TL Creds
• 🔒 Periodic Heartbeat Beacon Interval to Fixed External Destination · unlock with TL Creds
• 🔒 Protocol Tunneling / Non-Application-Layer Traffic Masquerading as Standard HTTPS with Lateral Tool Transfer · unlock with TL Creds
• 🔒 ZIP Archive Extraction Immediately Preceding Unsigned Binary Execution · unlock with TL Creds
• 🔒 Newly Registered / Typosquatted Domain Referral Preceding Installer Download · unlock with TL Creds

Indicators of compromise for MODBEACON gRPC RAT

As of 2026-07-10, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-1181.

How MODBEACON gRPC RAT works

MODBEACON is a newly identified Rust-based remote access trojan attributed to Silver Fox, a China-linked threat actor also tracked as Void Arachne, SwimSnake, and UTG-Q-1000. Unlike Silver Fox's historically opportunistic Gh0st RAT-derived toolset (WinOS/ValleyRAT, Atlas RAT, ABCDoor, RomulusLoader, SilentRunLoader), MODBEACON represents a step up in engineering maturity: the loader and beacon components are separated, the beacon's configuration is injectable at runtime, and the implant employs a plugin-based architecture referred to internally as 'native-v3' plugins, each exposing entry/init/fini relative-virtual-address (RVA) hooks that are mapped and executed entirely in memory without touching disk.

Distribution begins with SEO-poisoning campaigns that push counterfeit domains advertising bogus domestic (Chinese-market) software installers to the top of search results. Victims who download the fake installer receive a malicious ZIP archive; execution unpacks and loads MODBEACON's in-memory plugin chain rather than dropping a conventional dropper-plus-payload pair to disk, reducing forensic and AV footprint.

Once resident, MODBEACON performs host fingerprinting, establishes a heartbeat channel to command infrastructure, and reports command-execution results back over the C2 channel. Its most distinctive feature is the C2 transport: rather than a bespoke protocol, MODBEACON reuses transport-layer code from Xray/V2Ray, an open-source anti-censorship proxy framework, and carries it over gRPC streaming — giving the malware's encrypted C2 traffic the shape of ordinary HTTP/2-based application traffic. This channel is fronted by legitimate Amazon and Cloudflare CDN infrastructure, complicating network-based blocking since defenders cannot simply blackhole the fronting provider's IP ranges without breaking unrelated legitimate traffic.

Post-compromise, the beacon supports on-demand expansion via its plugin architecture: operators can push additional modules for information theft, lateral movement, or proxy forwarding through infected hosts, and MODBEACON establishes persistence via scheduled tasks. Observed targeting in mid-2026 focused on the technology, education, and state-owned-enterprise sectors across Asia, with confirmed victims in Cambodia including entities in the Cambodian online-gambling sector — consistent with Silver Fox's documented dual profile as both a nation-state-adjacent espionage actor and a for-hire 'traffic broker'/'cybercriminal arms dealer' that sells access and tooling to other criminal operators. No CVE or software vulnerability is associated with this campaign; MODBEACON is delivered exclusively via social-engineering-driven installer trojanization, consistent with Silver Fox's established pattern of typosquatted domains, stolen code-signing certificates, and trojanized popular applications (VPN clients, messaging apps, remote-access tools) documented in the group's parallel Atlas RAT and AtlasCross RAT campaigns.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Persistence

T1053 Scheduled Task/Job

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel

Collection

T1119 Automated Collection

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Execution

T1204 User Execution

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1583 Acquire Infrastructure

resource-development

T1608 Stage Capabilities

Remediation for MODBEACON gRPC RAT

Immediate actions

• Block or heavily scrutinize execution of installer binaries downloaded from search-engine results rather than official vendor domains
• Alert on gRPC/HTTP2 client connections originating from unexpected host processes (non-browser, non-service binaries)
• Hunt for scheduled tasks created outside standard software update mechanisms, especially those launching unsigned or newly-written binaries
• Restrict outbound access to CDN edge IP ranges from endpoints where such traffic is not expected, and inspect TLS SNI/JA3 fingerprints for anomalies on Amazon/Cloudflare-fronted connections

Workarounds

• Enforce DNS filtering / web-reputation blocking on newly registered and typosquatted domains impersonating popular software brands
• Restrict local user ability to install software outside of managed software-distribution channels

Longer-term hardening

• Deploy EDR with in-memory/reflective-loading detection (fileless plugin execution, RWX memory regions, RVA-based module mapping)
• Implement application allow-listing to prevent execution of installers from unmanaged/non-catalog sources
• User awareness training on SEO-poisoning risks — verifying software download sources against official vendor domains rather than trusting top search results
• Deploy network detection for anomalous gRPC/HTTP2 streams that do not match expected application behavior baselines

Affected and fixed versions

• N/A — Windows endpoints (counterfeit software installers)
  Vulnerable versions: all Windows versions targeted by trojanized installers

Timeline of MODBEACON gRPC RAT

• 2024-06-01 locked-ioc-16 begins documented operations, initially focused on Chinese-speaking targets before later expanding internationally — the operational baseline against which locked-ioc-18's 2026 emergence represents a toolset maturity step-up.
• 2025-10-27 Related locked-ioc-16 delivery infrastructure for the group's parallel locked-ioc-22/AtlasCross campaign registered (documented in vendor reporting), illustrating the actor's ongoing domain-registration cadence around the same period locked-ioc-18 tooling was in development.
• 2026-01-01 Trustwave SpiderLabs and other vendors publish broader profiling of locked-ioc-16's dual espionage/cybercrime operating model and toolset evolution.
• 2026-03-01 The Hacker News reports locked-ioc-16 expanding Asia cyber campaigns with AtlasCross RAT delivered via fake domains, part of the same actor's broader 2026 operational tempo preceding the locked-ioc-18 disclosure.
• 2026-05-31 China's National Computer Network Emergency Response Technical Team (CNCERT) issues a security alert about locked-ioc-16, foreshadowing the subsequent law-enforcement crackdown on the group.
• 2026-06-01 Chinese authorities carry out mass arrests of roughly 67 individuals linked to locked-ioc-16 across five provinces (Zhejiang, Jilin, Shandong, Guangdong), spanning roles from malware developers to phishing operators — reported in the same period as the locked-ioc-18 campaign's observed activity, though the arrests do not appear to have disrupted the locked-ioc-18 operation itself.
• 2026-06-15 locked-ioc-18 campaign activity observed in the wild, with SEO-poisoned counterfeit installers distributing the RAT to victims in Asia, including Cambodia.
• 2026-07-10 Threadlinqs Intelligence ingests and triages the locked-ioc-18 disclosure into the harness backlog for research.
• 2026-07-10 locked-ioc-24 publishes the underlying technical findings on locked-ioc-18, and The Hacker News publishes the first public disclosure summarizing its Rust-based plugin architecture, gRPC/Xray-derived C2 channel, and locked-ioc-16 attribution.

Sources cited for MODBEACON gRPC RAT

• Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers hexastrike.com · Vendor report · 2026-01-01
• Inside Silver Fox's Den: Trustwave SpiderLabs Unmasks a Global Threat Actor trustwave.com · Vendor report · 2026-01-01
• New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Communications The Hacker News · News · 2026-07-10
• Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains The Hacker News · News · 2026-03-01
• Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage infosecurity-magazine.com · News · 2026-01-01
• China arrests members of Silver Fox cybercrime group news.risky.biz · News · 2026-06-01
• Silver Fox APT Blurs the Line of Espionage & Cybercrime Dark Reading · News · 2026-01-01

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

More from Void Arachne

• AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate
• SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows Defenses
• Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor Download Sites
• ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading
• SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD
• AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver Fox Overlap)

Previous and next in malware

• Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor via PowerShell and TON Blockchain C2 (EtherHiding-style) Previous report
• Vidar Infostealer and XMRig Cryptominer Malvertising Campaign Targeting SMBs (Factory-v3 / X3D MINER) Next report