Silver Fox MODBEACON Rust RAT activity
Malware Activity
Summary
Hide ▲
Show ▼
The Silver Fox ecosystem has been tied to MODBEACON, a Rust-based remote access trojan that gives operators encrypted C2 and modular control over infected hosts. The malware is being pushed through counterfeit installers and bogus ZIP archives seeded by SEO poisoning, broadening exposure across technology, education, and state-owned enterprises. The design supports plugin loading, scheduled-task persistence, and follow-on payload expansion, raising the risk of stealthy long-term compromise. The C2 transport reuses Xray/V2Ray-style components and runs through Amazon and Cloudflare CDN infrastructure.
Related Happenings
Silver Fox counterfeit-installer SEO-poisoning campaign across Asia
Campaign
H score32
First: 10.07.2026 16:15
Last: 10.07.2026 16:15
Sources 1
How related:
One such campaign observed in mid-June 2026 involved a distributor delivering a previously undocumented modular RAT targeting technology, education, and state-owned enterprises in the country.
About this happening:
Silver Fox is running a **counterfeit-installer SEO-poisoning campaign** that delivers malware across **Asia** and puts **technology**, **education**, and **state-owned enterprise...
Silver Fox counterfeit-installer SEO-poisoning campaign across Asia
CampaignHow related: One such campaign observed in mid-June 2026 involved a distributor delivering a previously undocumented modular RAT targeting technology, education, and state-owned enterprises in the country.
About this happening: Silver Fox is running a **counterfeit-installer SEO-poisoning campaign** that delivers malware across **Asia** and puts **technology**, **education**, and **state-owned enterprise...
GammaWorm NTFS Alternate Data Streams propagation and backdoor activity
Malware Activity
H score40
First: 01.06.2026 14:00
Last: 01.06.2026 14:00
Sources 1
About this happening:
The **GammaWorm** malware activity now shows a more covert stage that hides modules in **NTFS Alternate Data Streams**, helping it spread across **Ukrainian networks** while leavi...
GammaWorm NTFS Alternate Data Streams propagation and backdoor activity
Malware ActivityAbout this happening: The **GammaWorm** malware activity now shows a more covert stage that hides modules in **NTFS Alternate Data Streams**, helping it spread across **Ukrainian networks** while leavi...
MIMICRAT (aka AstarionRAT) ClickFix-delivered RAT activity
Malware Activity
H score22
First: 20.02.2026 13:55
Last: 20.02.2026 13:55
Sources 1
About this happening:
The **MIMICRAT (aka AstarionRAT)** malware has been disclosed as a **ClickFix-delivered RAT** that enables **Windows token impersonation** and **SOCKS5 tunneling**, increasing the...
MIMICRAT (aka AstarionRAT) ClickFix-delivered RAT activity
Malware ActivityAbout this happening: The **MIMICRAT (aka AstarionRAT)** malware has been disclosed as a **ClickFix-delivered RAT** that enables **Windows token impersonation** and **SOCKS5 tunneling**, increasing the...
Timeline
-
10.07.2026 16:15 2 articles · 3h ago
Silver Fox MODBEACON Rust RAT activity
Initial DisclosureIn **mid-June 2026**, a distributor pushed **MODBEACON** through **counterfeit installers** and malicious **ZIP archives** advertised by **SEO-poisoned** search results. The infection chain targeted users tied to **technology, education, and state-owned enterprises**.
Show sources
- New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic — thehackernews.com — 10.07.2026 16:15
- New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic — thehackernews.com — 10.07.2026 16:15