New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

QiAnXin attributes a mid‑June 2026 campaign to the China‑linked cybercrime cluster “Silver Fox” that delivers a new Rust-based modular RAT called MODBEACON via counterfeit software installers and SEO-poisoning; the memory-resident implant uses a plugin architecture, gRPC tunnel streaming and reuses an open-source anti‑censorship transport (Xray/V2Ray) for C2 hosted on Amazon and Cloudflare CDN, and is used to fingerprint hosts, load in-memory plugins, execute commands, and maintain persistence for long-term access against targets in technology, education, and state-owned enterprises across Asia.