Three separate campaigns hit disclosure this week, each targeting different layers of the stack. BlueNoroff is tricking cryptocurrency holders into installing a fake meeting client. Red Menshen has been sitting inside telecom core networks for years using a kernel-level backdoor that leaves no listening ports. And Silver Fox is pushing a Rust-based trojan called MODBEACON that tunnels command traffic over gRPC. Here is what you need to know about each one, with the technical details that matter for defenders.
BlueNoroff fake meeting kit
The BlueNoroff group, a financially motivated cluster tied to Lazarus, has been running a phishing campaign that goes well beyond a fake login page. JUMPSEC researchers obtained the source code after attackers exposed JavaScript source maps on their live infrastructure. The kit impersonates Zoom and Microsoft Teams as single-page applications. When a victim clicks a link sent from a hijacked Telegram contact, the page requests webcam access via WebRTC and streams the video to attacker-controlled panels.
But the webcam capture is only the initial reconnaissance. The kit performs browser-based cryptocurrency wallet fingerprinting. It checks for EIP-6963 provider discovery, legacy window.ethereum objects, and non-EVM wallets like Solana. This lets operators decide which victims are worth deploying malware against before they push any payload.
The actual infection uses a ClickFix-style clipboard hijack. Within seconds of the fake meeting simulation, the victim sees a prompt to install a fake "Zoom SDK update." Copying the provided command triggers a PowerShell loader. Even if the user does not paste it, the kit can execute PowerShell payloads directly. The loader downloads a VBScript implant called Trojan.NukeSped, which establishes persistence, disables Microsoft Defender through exclusion policies, and runs WMI reconnaissance. It also enumerates browser extensions for cryptocurrency wallets like MetaMask and checks for Telegram session artifacts stored in IndexedDB. Hijacking active Telegram sessions lets attackers reuse the compromised account to target more victims.
On macOS, the attack uses shell scripts and Mach-O binaries. A fake Teams or Zoom installer acts as a decoy while background processes deploy a credential stealer that extracts Chrome passwords from the Keychain and exfiltrates them via Telegram bot.
The practical takeaway: if your organization handles cryptocurrency, treat unsolicited meeting invites from known contacts as suspicious. Monitor for unexpected webcam permission requests in the browser. Check for new PowerShell scheduled tasks or Defender exclusion policies. JUMPSEC identified at least eleven initial C2 domains. Pull your firewall logs against those indicators.
Red Menshen BPFDoor in telecom infrastructure
Red Menshen, also tracked as Earth Bluecrow and DecisiveArchitect, has been implanting a Linux kernel backdoor called BPFDoor inside telecom networks across at least ten countries. Rapid7 Labs published an analysis in March 2026 documenting seven or more variants. The backdoor uses the Berkeley Packet Filter framework to passively inspect all network traffic without opening a single listening port. Standard scans and monitoring tools see nothing. The backdoor sits dormant until it receives a precisely crafted "magic packet," then activates an encrypted reverse shell.
The newest variants add three capabilities. First, the magic packet is embedded inside normal HTTPS traffic at a fixed byte offset using a technique called the "magic ruler." Deep packet inspection tools operating on encrypted traffic cannot distinguish it from a legitimate request without session keys. Second, attacker-controlled hosts signal BPFDoor across internal network segments using ICMP packets with a specific destination marker field. That makes lateral movement commands appear as routine ICMP traffic. Third, recent builds masquerade as HPE ProLiant management services (hpasmlited) and Docker daemon processes, matching names and command-line arguments.
Red Menshen targets telecom subscriber management systems: HLR, HSS, UDM, authentication platforms, roaming databases, and 4G/5G core functions like AMF and SMF running in Kubernetes pods. The group uses CrossC2, Sliver, and TinyShell for lateral movement. Credential harvesting includes SSH brute-forcers with telecom-specific username "imsi" and custom ELF keyloggers. On Solaris systems, BPFDoor intercepts SCTP signaling traffic for automated collection.
Confirmed victims include telecoms in South Korea, Hong Kong, Myanmar, Malaysia, Egypt, India, Thailand, Turkey, Vietnam, Cambodia, and the United States. The Rapid7 report confirmed active infections at the time of publication.
Practical steps: run find / -name kdmtmpflush on every Linux server in your environment. Execute the Rapid7 BPFDoor detection script on all internet-facing Linux systems. Patch every Ivanti and Cisco edge appliance. That is the primary initial access vector Red Menshen exploits. If you manage telecom infrastructure, review your HLR/HSS access logs for unusual ICMP traffic patterns and investigate any process named hpasmlited or dockerd that does not match your expected service inventory.
MODBEACON RAT from Silver Fox
The China-linked cybercrime group Silver Fox has released a new Rust-based remote access trojan called MODBEACON. The malware uses gRPC streaming for encrypted C2 traffic, a design choice that provides bidirectional communication and strong encryption out of the box. The group propagates MODBEACON through counterfeit software installers and SEO poisoning, targeting technology, education, and state-owned enterprises in Asia.
MODBEACON is memory-resident and modular. It can fetch additional plugins, run operator commands, and report execution results. The C2 channel uses open-source anti-censorship proxy frameworks like Xray and V2Ray. The core capabilities include host fingerprinting, plugin loading, heartbeat messages, and persistence via scheduled tasks.
Silver Fox has been refining its tradecraft for some time. Earlier malware families include Atlas RAT, ABCDoor, RomulusLoader, and SilentRunLoader. MODBEACON represents a shift to Rust and a more sophisticated communication protocol. The use of gRPC makes traffic analysis harder because it is binary and multiplexed over HTTP/2. Traditional signature-based detection will struggle.
Practical takeaway: monitor outbound gRPC traffic from endpoints. gRPC tends to use port 443 but with a distinct TLS handshake and HTTP/2 preamble. Look for processes that create gRPC connections but are not part of known software. Inspect scheduled tasks for entries referencing unknown executables in user-writable directories. If you operate in the Asia-Pacific region, pay close attention to software download pages that rank via SEO. The group is known to poison search results for popular free tools.
What to do before the end of the week
These three campaigns cover very different attack surfaces. BlueNoroff targets individuals with cryptocurrency exposure through browser-based social engineering. Red Menshen targets telecom carriers at the kernel level. Silver Fox targets enterprise endpoints through trojanized installers. There is no single fix.
Start with the low-hanging fruit. Run the BPFDoor detection script on your Linux fleet. Check your Defender exclusion policies on Windows. Review any scheduled tasks that launched in the last 30 days. If you handle cryptocurrency, audit your team's Telegram usage and webcam permissions.
Specific numbers: JUMPSEC found 11 C2 domains for BlueNoroff. Rapid7 confirmed active BPFDoor infections in at least five countries as of March 2026. Silver Fox has at least six malware families in active rotation. The threat is not hypothetical. It is happening right now.