MODBEACON — Silver Fox Rust In-Memory RAT

MODBEACON is a new Rust-based remote access trojan attributed by QiAnXin to the China-linked cybercrime group Silver Fox (also tracked as SwimSnake, UTG-Q-1000, Void Arachne, and nicknamed "Ghost Distributor"). It was reported in mid-June 2026, with public coverage on 2026-07-10. It targets technology, education, and state-owned enterprises, primarily via Chinese-market software lures.

MODBEACON is memory-resident on 64-bit Windows and uses a modular, plugin-based architecture with an injectable configuration. Its distinguishing trait is C2 over gRPC carried on HTTP/2, wrapped in TLS — traffic that closely mimics ordinary encrypted web traffic — and it fronts its command-and-control through Amazon and Cloudflare CDN infrastructure, so the destination IPs look benign. Capabilities include host fingerprinting, plugin loading, heartbeat/keepalive messaging, command execution with result reporting, and persistence via scheduled tasks.

Delivery follows Silver Fox's established playbook: SEO-poisoning places counterfeit download pages for popular software (the group has previously impersonated Teams, Zoom, Signal, Telegram, and Chinese tax tools) high in search results, luring victims into downloading malicious ZIP archives / fake installers. Silver Fox operates a broad distribution network and rotates a large arsenal (ValleyRAT, Atlas RAT, ABCDoor, RomulusLoader, SilentRunLoader), so MODBEACON should be treated as one payload of an adaptable operator.

Defender priority: Because MODBEACON runs in memory and beacons over TLS gRPC through legitimate CDNs, network IOC blocking alone will fail. The highest-value catch is on the endpoint at the delivery and persistence seams — a freshly-downloaded fake installer executing from a Downloads/Temp/archive path (Q1), a scheduled task registered right after (Q3), and discovery/loader activity around it (Q4/Q5). Hunt those first.

Intel gap / provenance note: No MODBEACON-specific atomic IOCs (payload hashes, CDN-fronted C2 hostnames, task names) are published in the reviewed sources. Atomic C2 (e.g. an IP/port) from other Silver Fox ValleyRAT campaigns is deliberately not imported here — it belongs to a different payload. The IOC appendix ships REPLACE_WITH_… placeholders; every operative indicator in this pack is behavioral, and nothing atomic is fabricated.

Hunt hypotheses (fidelity-ordered)

Attack chain

Behavior-first pack. Atomic rows are placeholders to fill from IR / a vendor report; behavioral rows are the operative indicators today.

• Web proxy / SWG logs: Surface downloads of .zip/.msi/.exe named like popular software from freshly-registered or low-reputation domains reached via a search-engine referrer — the SEO-poisoning tell.
• DNS logs: Look for endpoints resolving CDN edge hostnames (Amazon CloudFront / Cloudflare) that no browser process subsequently loads a normal web page from — non-browser CDN use is the anomaly, not the CDN itself.
• Windows Task Scheduler operational log (Event ID 106/140/200): New task registrations correlated in time with a fresh installer execution.
• MOTW / Mark-of-the-Web: Investigate ZIP-extracted executables that ran with an Internet zone identifier from a user profile path.
• Sysmon (if deployed): Event ID 7 (image load) of unsigned/anomalous DLLs from user-writable directories; Event ID 8/10 for injection into benign processes.

None of these should be promoted to blocking in isolation — the fidelity comes from the combination (installer + task + discovery + loader on the same host in a short window). Keep as detect/investigate and let analysts correlate.

• Telemetry ready: Confirm ProcessRollup2, ScheduledTaskRegistered, PeFileWritten, and NetworkConnectIP4 are all flowing from your workstation fleet.
• Benign baseline: Run Q1 and Q3 over a week to learn which installers and task registrations are normal in your environment, then apply the TUNING exclusions.
• Positive test: From a lab VM, run a benign renamed setup.exe out of Downloads and register a task pointing at an AppData path; confirm Q1 and Q3 fire and can be time-correlated.
• Combination scoring: Build a host-scoped correlation (Q1 ∩ Q3 ∩ Q4 within a short window) before alerting — single queries here are medium-fidelity by design.
• C2 caveat: Do NOT alert on Q2 alone; use it only to enrich a host already flagged by the endpoint hunts.

Defender ASR — block executable content from user paths (audit → enforce)

# Start in AUDIT to measure impact, then flip to ENFORCE (1) after review.
# "Block executable files from running unless they meet a prevalence, age, or trusted list criterion"
$rule = "01443614-cd74-433a-b99e-2ecdc07bfc25"
Add-MpPreference -AttackSurfaceReductionRules_Ids $rule -AttackSurfaceReductionRules_Actions AuditMode
# After review:
# Set-MpPreference -AttackSurfaceReductionRules_Ids $rule -AttackSurfaceReductionRules_Actions Enabled
Get-MpPreference | Select-Object -Expand AttackSurfaceReductionRules_Ids

AppLocker — deny execution from Downloads / Temp (starter rule intent)

# Create a default-allow-with-explicit-deny for user-writable dirs, or better,
# default-deny with an allow-list. Deny paths (Exe + Dll collections):
#   %OSDRIVE%\Users\*\Downloads\*
#   %OSDRIVE%\Users\*\AppData\Local\Temp\*
# Deploy via GPO: Computer Config -> Windows Settings -> Security Settings ->
#   Application Control Policies -> AppLocker. Enforce Exe + Dll rule collections.
Get-AppLockerPolicy -Effective -Xml   # verify effective policy after GPO refresh

Sweep + remove a MODBEACON persistence task

# Identify tasks running from user-writable paths (see audit block), then remove a confirmed one:
Unregister-ScheduledTask -TaskName "REPLACE_WITH_TASK_NAME" -Confirm:$false
# Kill the in-memory implant host (identify via Falcon process tree first), then reimage
# if in-memory-only execution is confirmed — memory-resident implants leave little on disk.

Gaps: (1) C2 is TLS gRPC fronted through Amazon/Cloudflare CDN — destination IPs are legitimate, so network detection is inherently low-fidelity (Q2 is enrich-only). (2) MODBEACON is memory-resident, so on-disk file IOCs are sparse; coverage leans on the delivery + persistence + discovery seams and on combination scoring rather than any single atomic. Populate S10 placeholders once IR yields hashes/hostnames.