DNS Request For Hyphen Mirrored Domains - Silver Fox Atlas RAT

Collin Lairamore@Bollinmore

•updated May 4, 2026•5•0•198

This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article trezor-trezor[.]com signal-signal[.]com quickq-quickq[.]com eyy-eyy[.]com