---
title: Hunt: AtlasRAT C2 (Silver Fox-linked) now on TLS/443 — 'BFuck' check-in, JA3 e26606c5…, fake update.microsoft.com cert | ctxsec
url: https://ctxsec.com/items/hunt-atlasrat-tls-c2
description: ""
status: "hunt idea (Netresec IOCs + Suricata)"
published: 2026-10-12
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-atlasrat-tls-c2.md)

hunt idea (Netresec IOCs + Suricata)

2026-10-12

### Hunt: AtlasRAT C2 (Silver Fox-linked) now on TLS/443 — 'BFuck' check-in, JA3 e26606c5…, fake update.microsoft.com cert

Netresec says AtlasRAT's loader check-in changed from 'SFuck\0\0\0' (TCP 886/9899) to 'BFuck\0\0\0' on 443 around May 2026. From July the backdoor follows the check-in with a TLS session: JA3 e26606c572e55d499b0676e9095e3df8, JA3S f98a4985f829b6513fbeccf5b751b458, and a self-signed cert posing as update.microsoft.com (SHA-1 a66308a1fb09c8345228ca00335e633b2dabde53). Netresec published Suricata SIDs 1471105–1471108 for the two check-ins, the TLS ClientHello and the fake cert. IOCs include 23.226.57.50, 38.76.177.46, 43.99.101.175, 45.142.152.180, 116.204.169.70, 150.158.50.175, 156.234.7.48 and 192.252.180.45 (all :443), plus laicaishuli[.]com, yilufafafa[.]club and zixungongsi[.]top. Netresec says the Silver Fox link is circumstantial (ValleyRAT and AtlasRAT seen on the same C2 servers on different ports). Look for a self-signed 'update.microsoft.com' cert on a non-Microsoft IP.

Sources: [Netresec (Oct 12)](https://www.netresec.com/?month=2026-10&page=Blog&post=Detecting-AtlasRAT-C2) · [Netresec Suricata rules](https://github.com/Netresec/Suricata)