Netresec says AtlasRAT's loader check-in changed from 'SFuck\0\0\0' (TCP 886/9899) to 'BFuck\0\0\0' on 443 around May 2026. From July the backdoor follows the check-in with a TLS session: JA3 e26606c572e55d499b0676e9095e3df8, JA3S f98a4985f829b6513fbeccf5b751b458, and a self-signed cert posing as update.microsoft.com (SHA-1 a66308a1fb09c8345228ca00335e633b2dabde53). Netresec published Suricata SIDs 1471105–1471108 for the two check-ins, the TLS ClientHello and the fake cert. IOCs include 23.226.57.50, 38.76.177.46, 43.99.101.175, 45.142.152.180, 116.204.169.70, 150.158.50.175, 156.234.7.48 and 192.252.180.45 (all :443), plus laicaishuli[.]com, yilufafafa[.]club and zixungongsi[.]top. Netresec says the Silver Fox link is circumstantial (ValleyRAT and AtlasRAT seen on the same C2 servers on different ports). Look for a self-signed 'update.microsoft.com' cert on a non-Microsoft IP.