Silver Fox (China-Linked) Deploys MODBEACON Rust RAT With gRPC-Encrypted C2, Targeting Asian Tech and State-Owned Enterprises

QiAnXin on July 10 attributed a previously undocumented Rust-based RAT, MODBEACON, to the China-linked Silver Fox cluster, which distributes it via SEO-poisoned counterfeit software installers across Asia. MODBEACON uses gRPC streaming over TLS for command-and-control, routing traffic through Amazon and Cloudflare CDN infrastructure to blend with legitimate application traffic and defeat signature-based network detection — raising the detection bar to protocol-aware inspection and behavioral baselining. QiAnXin characterizes Silver Fox as a multi-distributor operation that despite appearing low-sophistication masks a structurally complex organization, deploying Gh0st RAT and WinOS/ValleyRAT variants in parallel and acting as both a 'cybercriminal arms dealer' and traffic broker across technology, education, and state-owned enterprise targets.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.