Do Son 
At a glance
| Actor | A Silver Fox (UTG-Q-1000) Ghost distributor — assessed “hybrid threat actor” |
| Activity | SEO-poisoned fake installers deliver Ghost and the MODBEACON Rust trojan |
| Targets | Technology, education, and state-owned firms in Asia; Cambodian gambling operators |
| Scale | “Large number” of government and enterprise victims claimed (Qianxin/VirusTotal); exact count not disclosed |
| Law-enforcement status | No arrests or charges; Qianxin SkyEye can intercept the shellcode |
| Source | Qianxin Red Raindrop Team |
TL;DR
Qianxin’s Red Raindrop Team found a Silver Fox operator pushing a new Rust trojan. Named MODBEACON, it lands on hand-picked targets in tech, education, and state firms. The same crew also runs “black-on-black” attacks on Cambodia’s gambling scene.
What happened
From fake software to MODBEACON
Silver Fox is a name for high-volume, low-skill crime in China. Behind it sits a malware-as-a-service style network of distributors. They flood search results with fake installers for popular apps. Victims then grab trojanized MuMu, Sogou, WPS, or ToDesk builds. Those setups drop Ghost and ValleyRat malware. Also, the fake lures pose as game and office tools. Qianxin tracks this effort as Operation Phnom Penh. In mid-June 2026, it caught one distributor going further. That distributor sent MODBEACON, a modular Rust implant, to select victims. The 2025 version only pushed fraud links in chats. This one aims higher, with a custom trojan. Qianxin says “the overall engineering quality is high.” The counterfeit sites trace back to at least September 2025.
How MODBEACON hides
MODBEACON splits its loader and beacon to stay quiet. It loads plugins in memory and syncs config on demand. For C2, it borrows the transport from the Xray proxy. So its traffic mimics normal HTTP/2 and gRPC calls. Because the tunnel looks normal, filters often miss it. The C2 domains sit behind Amazon and Cloudflare CDNs. An agent token guards each check-in with the server. The beacon reports status and runs remote commands. Ghost also pins persistence with a hidden WMI timer.
Who is behind it
Qianxin ties the campaign to a Silver Fox Ghost distributor. Other vendors track the same group as UTG-Q-1000. It has run SEO and phishing scams since 2022. Meanwhile, Kaspersky recently tied Silver Fox to Rust loaders. Silver Fox chases both money and secrets, those vendors note. Qianxin stops short of naming a state sponsor. Still, the behavior looks odd for plain crime. The crew filters victims by industry and grades access by value. Its Cambodian lures echo past GoldenEye Dog campaigns. Qianxin says the motives “can no longer be explained by purely economic objectives.” So it flags possible outsourced political intent. Even so, Qianxin treats attribution with care. The team calls the actor a “hybrid threat actor.”
Impact and scale
This operator mixes fraud with espionage-style access. First, it harvests endpoints across Asia through SEO scams. Then it rents or sells the best access to choosier clients. So the crew profits twice from each break-in. Also, tiered access lets it pick premium buyers. VirusTotal data points to many government and firm victims. The targets span manufacturing, education, finance, and healthcare. Cambodia-themed lures cite Poipet, Sihanoukville, and Phnom Penh. Some even ship in Khmer to hook local readers. Later, memory plugins can add theft or lateral movement.
What comes next and how to stay protected
The campaign looks active, and no arrests have followed. Avoid software from search ads or lookalike domains. Fetch installers only from official vendor pages. Then verify any download against the vendor’s hash. Deploy EDR and turn on PowerShell and WMI logging. Block the listed C2 domains and audit new WMI events. Hunt for the CBPUserTimer task and its odd mutex. Also watch outbound gRPC traffic to new CDN domains. Therefore, treat cracked installers as a real threat.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
