New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

A new remote access trojan called MODBEACON has been linked to the China-connected cybercrime group Silver Fox. MODBEACON is a Rust-based RAT that utilizes gRPC streaming for encrypted command and control traffic. The threat cluster behind MODBEACON appears to be a low-sophistication, high-activity operation that spreads malware through fake installers and SEO poisoning techniques. Despite this appearance, the group's true organizational capabilities may be more complex. Chinese cybersecurity company QiAnXin has identified the MODBEACON RAT and its associated tactics. The discovery suggests that Silver Fox is continuing to evolve its malware and techniques.