# AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate

> AtlasRAT is a modular Windows RAT delivered through a four-stage in-memory loader chain and tied, on circumstantial evidence, to the Chinese-speaking cybercrime cluster Silver Fox (TA4922). Netresec documents how its C2 protocol evolved through 2026 from a plaintext 'SFuck' check-in to 'BFuck', XOR obfuscation and TLS with a distinctive JA3 and a self-signed certificate impersonating update.microsoft.com, and publishes network IOCs and Suricata rules.

- **Published:** 2026-10-24T22:30:47Z
- **Last reviewed:** 2026-10-24T22:30:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4419
- **ID:** TL-2026-4419
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Void Arachne (China)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AtlasRAT (Malpedia: win.atlas_rat; also reported as AtlasCross RAT by Hexastrike) is a Windows remote access trojan that Proofpoint describes as a modular backdoor with a core module and optional plugins. It is delivered in multiple stages and is attributed by Proofpoint to TA4922, a Chinese-speaking, financially motivated crime group. Netresec (Erik Hjelmvik, 2026-10-12) links AtlasRAT to Silver Fox (also tracked as Void Arachne, TA4922, SwimSnake, UTG-Q-1000, The Great Thief of Valley). Netresec calls the link circumstantial, noting that ValleyRAT and AtlasRAT were seen on the same C2 servers on different ports, which suggests a shared operator. AhnLab ASEC says the evidence does not conclusively show the same operator and raises the possibility of a commercial or builder-based ecosystem.

Delivery and loader chain: Hexastrike reports Chinese-speaking users lured to typosquatted sites impersonating Zoom, Signal, Telegram, Surfshark, Microsoft Teams, Trezor, UltraViewer, QuickQ and others (eleven domains registered 2025-10-27). The sites serve ZIP archives containing a trojanized Autodesk installer plus a legitimate decoy application, signed with a stolen Extended Validation certificate issued to DUC FABULOUS CO., LTD (Hanoi). The shellcode loader decrypts an embedded Gh0st RAT-style configuration and pulls a second-stage payload from bifa668.com over TCP/9899. AhnLab ASEC (2026-07-28) documents a four-stage in-memory chain: (1) a Delphi executable, FlashPlay.Exe, disguised as 'AGE Flash Player', acting as an in-memory PE loader; (2) encrypted shellcode fragments rebuilt with Base64, XOR and AES-256-CBC into a 1,374-byte x86 downloader; (3) a C2-delivered loader that is manually mapped and invoked through ServiceRun; (4) the final payload MainDll.Dll with the RAT and plugin framework. Netresec observes that the loader's check-in retrieves 300-500 kB of shellcode containing a DLL with the full backdoor. Proofpoint also notes TA4922 campaigns use ZIP/RAR archives on file-sharing platforms and DLL sideloading, and move victims to messaging apps such as LINE, WhatsApp and Teams.

Capabilities and persistence: system reconnaissance, file enumeration and theft, offline keylogging, screenshot, webcam and audio capture, DLL injection into WeChat.exe via LoadLibraryW, security-product detection and process enumeration, and modular plugins. Persistence86.Dll provides UAC bypass (CMSTPLUA and registry hijacking) and persistence through BITS database tampering, NTUSER.MAN modification, Run key and WPTask changes. PDB strings reference 'atlasPro' builds dated 2026.6.2. Hexastrike additionally reports a PowerChell engine that disables AMSI, ETW, Constrained Language Mode and ScriptBlock logging.

C2 protocol evolution (Netresec): the legacy variant opens with the 8 bytes 53 46 75 63 6b 00 00 00 ('SFuck') on TCP 886 and 9899. From late March 2026 the data is XORed with a fixed key beginning a7 3b f1 8c. From May 2026 the check-in changes to 42 46 75 63 6b 00 00 00 ('BFuck') on TCP 443. From July 2026 the C2 uses TLS with JA3 e26606c572e55d499b0676e9095e3df8, JA3S f98a4985f829b6513fbeccf5b751b458 and a self-signed certificate impersonating update.microsoft.com (SHA-1 a66308a1fb09c8345228ca00335e633b2dabde53). Inside the channel, a 56-byte cleartext header carries sequence number, compressed size, original size, flags, a 32-byte ChaCha20 key and an 8-byte nonce. Netresec publishes Suricata rules SID 1471105-1471108 at github.com/Netresec/Suricata. Defenders can hunt on the check-in markers, the JA3/JA3S pair, the certificate fingerprint and the listed infrastructure.

Sourcing note: severity is an analyst judgment and no CVE or CVSS applies. IOC values were taken from the Netresec article via an automated page summary and cross-checked where possible; AhnLab independently lists 150.158.50.175:443, 116.204.169.70 and bifa668.com. Verify the remaining values against the original post before blocking. A BeaconBeagle lookup for 45.142.152.180 returned HTTP 404 (no record).

## MITRE ATT&CK

- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1553.002 Code Signing
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1112 Modify Registry
- T1197 BITS Jobs
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1548.002 Bypass User Account Control
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1095 Non-Application Layer Protocol
- T1573.001 Symmetric Cryptography
- T1587.003 Digital Certificates

## Sources

- [Detecting AtlasRAT C2 - Netresec (Erik Hjelmvik)](https://www.netresec.com/?page=Blog&month=2026-10&post=Detecting-AtlasRAT-C2)
- [Malpedia library entry: Detecting AtlasRAT C2 (win.atlas_rat)](https://malpedia.caad.fkie.fraunhofer.de/library/f75a8ee5-5321-406a-b313-70c87b0d510e/)
- [Malpedia: Atlas RAT (win.atlas_rat)](https://malpedia.caad.fkie.fraunhofer.de/details/win.atlas_rat)
- [Not Every Fox is Silver: Inside an AtlasRAT loader chain - AhnLab ASEC](https://asec.ahnlab.com/en/94704/)
- [TA4922: The Suspected Chinese Crime Group is Going Global - Proofpoint](https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global)
- [Silver Fox Expands Asia Cyber Campaign - The Hacker News](https://thehackernews.com/2026/03/silver-fox-expands-asia-cyber-campaign.html)
- [Netresec Suricata rules (SID 1471105-1471108)](https://github.com/Netresec/Suricata)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4419