Threat reportMalwareTL-2026-4419
AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate
AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution (TL-2026-4419), also tracked as Atlas RAT, is a high-severity malware campaign, first published 2026-10-24. It is attributed to Void Arachne (China) with low confidence, affects Microsoft Windows, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 2Void Arachne
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4419
- Threat ID
- TL-2026-4419
- Also known as
- Atlas RAT, AtlasCross RAT, win.atlas_rat, atlasPro
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Void Arachne, TA4922
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- enterprise, technology, finance, cryptocurrency, general-consumer
- Target regions
- East Asia, Europe, Africa
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution
Malware and tooling: AtlasRAT, ValleyRAT
How AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution works
AtlasRAT is a modular Windows RAT delivered through a four-stage in-memory loader chain and tied, on circumstantial evidence, to the Chinese-speaking cybercrime cluster Silver Fox (TA4922). Netresec documents how its C2 protocol evolved through 2026 from a plaintext 'SFuck' check-in to 'BFuck', XOR obfuscation and TLS with a distinctive JA3 and a self-signed certificate impersonating update.microsoft.com, and publishes network IOCs and Suricata rules.
AtlasRAT (Malpedia: win.atlas_rat; also reported as AtlasCross RAT by Hexastrike) is a Windows remote access trojan that Proofpoint describes as a modular backdoor with a core module and optional plugins. It is delivered in multiple stages and is attributed by Proofpoint to TA4922, a Chinese-speaking, financially motivated crime group. Netresec (Erik Hjelmvik, 2026-10-12) links AtlasRAT to Silver Fox (also tracked as Void Arachne, TA4922, SwimSnake, UTG-Q-1000, The Great Thief of Valley). Netresec calls the link circumstantial, noting that ValleyRAT and AtlasRAT were seen on the same C2 servers on different ports, which suggests a shared operator. AhnLab ASEC says the evidence does not conclusively show the same operator and raises the possibility of a commercial or builder-based ecosystem.
Delivery and loader chain: Hexastrike reports Chinese-speaking users lured to typosquatted sites impersonating Zoom, Signal, Telegram, Surfshark, Microsoft Teams, Trezor, UltraViewer, QuickQ and others (eleven domains registered 2025-10-27). The sites serve ZIP archives containing a trojanized Autodesk installer plus a legitimate decoy application, signed with a stolen Extended Validation certificate issued to DUC FABULOUS CO., LTD (Hanoi). The shellcode loader decrypts an embedded Gh0st RAT-style configuration and pulls a second-stage payload from bifa668.com over TCP/9899. AhnLab ASEC (2026-07-28) documents a four-stage in-memory chain: (1) a Delphi executable, FlashPlay.Exe, disguised as 'AGE Flash Player', acting as an in-memory PE loader; (2) encrypted shellcode fragments rebuilt with Base64, XOR and AES-256-CBC into a 1,374-byte x86 downloader; (3) a C2-delivered loader that is manually mapped and invoked through ServiceRun; (4) the final payload MainDll.Dll with the RAT and plugin framework. Netresec observes that the loader's check-in retrieves 300-500 kB of shellcode containing a DLL with the full backdoor. Proofpoint also notes TA4922 campaigns use ZIP/RAR archives on file-sharing platforms and DLL sideloading, and move victims to messaging apps such as LINE, WhatsApp and Teams.
Capabilities and persistence: system reconnaissance, file enumeration and theft, offline keylogging, screenshot, webcam and audio capture, DLL injection into WeChat.exe via LoadLibraryW, security-product detection and process enumeration, and modular plugins. Persistence86.Dll provides UAC bypass (CMSTPLUA and registry hijacking) and persistence through BITS database tampering, NTUSER.MAN modification, Run key and WPTask changes. PDB strings reference 'atlasPro' builds dated 2026.6.2. Hexastrike additionally reports a PowerChell engine that disables AMSI, ETW, Constrained Language Mode and ScriptBlock logging.
C2 protocol evolution (Netresec): the legacy variant opens with the 8 bytes 53 46 75 63 6b 00 00 00 ('SFuck') on TCP 886 and 9899. From late March 2026 the data is XORed with a fixed key beginning a7 3b f1 8c. From May 2026 the check-in changes to 42 46 75 63 6b 00 00 00 ('BFuck') on TCP 443. From July 2026 the C2 uses TLS with JA3 e26606c572e55d499b0676e9095e3df8, JA3S f98a4985f829b6513fbeccf5b751b458 and a self-signed certificate impersonating update.microsoft.com (SHA-1 a66308a1fb09c8345228ca00335e633b2dabde53). Inside the channel, a 56-byte cleartext header carries sequence number, compressed size, original size, flags, a 32-byte ChaCha20 key and an 8-byte nonce. Netresec publishes Suricata rules SID 1471105-1471108 at github.com/Netresec/Suricata. Defenders can hunt on the check-in markers, the JA3/JA3S pair, the certificate fingerprint and the listed infrastructure.
Sourcing note: severity is an analyst judgment and no CVE or CVSS applies. IOC values were taken from the Netresec article via an automated page summary and cross-checked where possible; AhnLab independently lists 150.158.50.175:443, 116.204.169.70 and bifa668.com. Verify the remaining values against the original post before blocking. A BeaconBeagle lookup for 45.142.152.180 returned HTTP 404 (no record).
MITRE ATT&CK techniques used in TL-2026-4419
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Discovery
T1057 Process Discovery; T1518.001 Security Software Discovery
Command and Control
T1095 Non-Application Layer Protocol; T1573.001 Symmetric Cryptography
defense-impairment
T1112 Modify Registry; T1553.002 Code Signing; T1685 Disable or Modify Tools
Persistence
T1197 BITS Jobs; T1547.001 Registry Run Keys / Startup Folder
Execution
Privilege Escalation
T1548.002 Bypass User Account Control
stealth
Resource Development
Affected products and versions in AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution
- Microsoft — Windows
Vulnerable versions: Windows endpoints (user-executed malware; not version-specific)
Remediation for AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution
Immediate actions
- Block the listed C2 IPs on TCP/443 and the listed domains at perimeter and DNS
- Deploy Netresec Suricata rules SID 1471105-1471108 and alert on the JA3 e26606c572e55d499b0676e9095e3df8 / JA3S f98a4985f829b6513fbeccf5b751b458 pair
- Alert on TLS certificates with CN update.microsoft.com served by non-Microsoft hosts (SHA-1 a66308a1fb09c8345228ca00335e633b2dabde53)
- Hunt for FlashPlay.Exe, MainDll.Dll and Persistence86.Dll, and for unexpected BITS jobs or NTUSER.MAN changes
Workarounds
- Block outbound TCP 886 and 9899 where not required
- Use TLS inspection or JA3 allow/deny lists on egress
Longer-term hardening
- Restrict software installation to approved sources and block ZIP/RAR execution from user-writable paths
- Monitor for DLL injection into WeChat.exe and LoadLibraryW use from unsigned processes
- Enable AMSI, ETW and PowerShell ScriptBlock logging with tamper alerting
- Revoke trust in code-signing certificates issued to DUC FABULOUS CO., LTD
Timeline of AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution
- Eleven typosquatted delivery domains (e.g. app-zoom.com, www-teams.com, www-surfshark.com) registered, per Hexastrike.
- Silver Fox AtlasCross/Atlas RAT campaign targeting Chinese-speaking users begins (December 2025, per Hexastrike via The Hacker News).
- Hexastrike publishes 'Trust the Tunnel, Get the Trojan', linking Atlas RAT delivery via weaponized VPN installers to Silver Fox; stolen DUC FABULOUS CO., LTD EV certificate used for signing.
- Late March 2026: C2 traffic starts being XOR-encrypted with a fixed key beginning a7 3b f1 8c (Netresec; exact day not stated, late March through July).
- May 2026: check-in marker changes from 'SFuck' to 'BFuck' and the primary C2 port moves to TCP 443 (Netresec; exact day not stated).
- Proofpoint publishes 'TA4922: The Suspected Chinese Crime Group is Going Global', covering Atlas RAT and expansion into Europe and Africa after a March-April 2026 surge in tempo.
- July 2026: C2 moves to TLS with JA3 e26606c572e55d499b0676e9095e3df8 and a self-signed certificate impersonating update.microsoft.com (Netresec; exact day not stated).
- AhnLab ASEC publishes 'Not Every Fox is Silver', detailing the four-stage in-memory loader chain, MainDll.Dll and Persistence86.Dll.
- Netresec publishes 'Detecting AtlasRAT C2' with C2 protocol evolution, IOCs and Suricata rules SID 1471105-1471108.
Sources cited for AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution
- Detecting AtlasRAT C2 - Netresec (Erik Hjelmvik)
- Malpedia library entry: Detecting AtlasRAT C2 (win.atlas_rat)
- Malpedia: Atlas RAT (win.atlas_rat)
- Not Every Fox is Silver: Inside an AtlasRAT loader chain - AhnLab ASEC
- TA4922: The Suspected Chinese Crime Group is Going Global - Proofpoint
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers - Hexastrike (listed on Malpedia)
- Silver Fox Expands Asia Cyber Campaign - The Hacker News
- Netresec Suricata rules (SID 1471105-1471108)
Detection coverage for TL-2026-4419
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4419 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4419
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.