New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

Key Points:

• A new Rust-based remote access trojan (RAT) named MODBEACON has been linked to the Silver Fox cybercrime group, utilizing gRPC streaming for encrypted command-and-control (C2) traffic.
• The malware targets technology, education, and state-owned enterprises in Asia, leveraging counterfeit software installers and SEO poisoning techniques for distribution. Its sophisticated design allows for long-term access and minimal detection.
• Recommended actions include monitoring for suspicious installer downloads, implementing network segmentation to limit lateral movement, and enhancing user awareness training to mitigate social engineering risks.

Technical Details: MODBEACON employs a modular architecture with a plugin-based system for its C2 operations, utilizing gRPC for secure communications. The malware is designed to fetch additional modules and execute commands from attackers.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - Exploit Public-Facing Application (Initial Access)
• T1070.001 - Indicator Removal on Host: File Deletion (Defense Evasion)

IOCs Mentioned: None mentioned