Executive Summary
A suspected China-nexus threat actor known as Silver Fox (or UTG-Q-1000) has launched a campaign dubbed 'Operation Phnom Penh' targeting technology, education, and state-owned enterprises across Asia. The actor functions as a hybrid threat entity, acting as both a traffic broker and a distributor of sophisticated custom malware. Recent activities show a shift toward higher technical sophistication with the deployment of MODBEACON, a professional-grade remote access trojan (RAT).
MODBEACON is written in Rust and utilizes gRPC tunnel streaming for its command-and-control (C2) channel, specifically hijacking the transport layer of the open-source Xray/V2Ray anti-censorship framework. This technique allows the malware to disguise malicious traffic as standard HTTP/2 and gRPC bidirectional streaming, effectively evading traditional network-layer inspection. The campaign also demonstrates 'black-on-black' operations targeting the Cambodian gambling sector, indicating diverse operational motives.
The deployment of MODBEACON marks a significant evolution in Silver Fox's arsenal, which previously relied on high-volume, lower-sophistication tools like Gh0st RAT and WinOS. The modular nature of MODBEACON, supporting in-memory plugin loading and professional-grade obfuscation, suggests the actor is providing high-value access to downstream 'clients' or executing specialized missions beyond simple financial fraud.