MODBEACON shifts RAT command traffic to gRPC streaming
MODBEACON shifts RAT command traffic to gRPC streaming
A new MODBEACON RAT variant uses gRPC streaming to carry encrypted command-and-control traffic, replacing more typical web-style beaconing with a protocol common in modern backend services. The malware’s network profile is designed to blend into legitimate encrypted application traffic rather than expose distinct C2 patterns.
Operationally, this raises the detection burden from simple signature matching to protocol-aware inspection and traffic baselining. gRPC over encrypted channels can reduce visibility for defenders and complicate separation of benign service traffic from active remote access activity.
️ Open sources - closed narratives
Source: Telegram "sitreports"