type: entity · created: 2026-07-11 · updated: 2026-07-11 · tags: [rat, c2, loader] · confidence: medium · affected_sectors: [technology, education, government] · au_impact: false
MODBEACON RAT
MODBEACON is a Rust-based remote access trojan (RAT) attributed by QiAnXin Threat Intelligence to the China-linked Silver Fox cybercrime group. It uses gRPC streaming for encrypted command-and-control (C2) communication — a relatively modern and stealthy C2 channel.
Technical Details
- Language: Rust
- C2 protocol: gRPC streaming (encrypted)
- Infrastructure: Hosted on Amazon (AWS) and Cloudflare CDN
- Advanced C2: gRPC provides bidirectional streaming with native encryption, making traffic analysis harder
Distribution
- SEO poisoning — victims search for legitimate software and find counterfeit installer sites
- Targets technology, education, and state-owned enterprises across Asia (raw/digests/Cyber-Digest-2026-07-11.md)
Related Pages
- Silver Fox — The threat group operating this malware
- Longleash — Another China-linked malware (targets networking devices)
- Gigawiper — Destructive backdoor with different objectives