Technical Architecture and Communication
Researchers at QiAnXin have identified a new remote access trojan named MODBEACON, coded in Rust and attributed to the China linked Silver Fox cybercrime group. This implant represents a significant technical advance, as its command and control (C2) communication relies on gRPC tunnel streaming. The malware reuses the transport layer from the open source anti-censorship proxy framework Xray or V2Ray to create its encrypted C2 channel, making detection and traffic analysis more difficult.
MODBEACON operates entirely in memory and uses a plugin based architecture with native v3 plugins. The loader and beacon components are separated, and the configuration is injectable. Core capabilities include host fingerprinting, in memory plugin loading, sending heartbeat messages, reporting command execution results, and establishing persistence through scheduled tasks.
Campaign Tactics and Distribution
The infection chain begins with SEO poisoning campaigns. Attackers create counterfeit domains offering fake installers for popular domestic software, tricking users into downloading malicious ZIP archives that deploy the trojan. The C2 infrastructure is hosted on Amazon and Cloudflare’s content delivery network.
QiAnXin describes the distributor behind this specific campaign as a hybrid threat actor that functions as both a cybercriminal arms dealer and a traffic broker. This group simultaneously expands its infection footprint across Asia through daily SEO operations for fraud while advancing trojan development or renting high value access to downstream customers. The Silver Fox ecosystem continues to broaden its malware arsenal, which now includes families such as Atlas RAT, ABCDoor, RomulusLoader, and SilentRunLoader.
Source: The Hacker News
