TA4922 expanded targeting to organizations in the U.K., Germany, Italy, and South Africa while continuing campaigns against East Asia.

Key Findings: TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal. The group has been

TA4922 is a highly sophisticated cybercriminal group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe and Africa. Proofpoint and subsequent investigation uncovered multiple related network indicators, victim communications, and infrastructure artifacts tied to malicious domains, subdomains, and IP addresses. #TA4922 #AtlasRAT #RomulusLoader #SilentRunLoader #ValleyRAT #Winos4.0 #Proofpoint #nwphotoblogcom #wsztts88cyou

TA4922 is a financially motivated Chinese-speaking cybercrime

TA4922 is a highly active Chinese-speaking threat actor that has evolved its toolkit to include Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT/Winos4.0 while using regional HR, payroll, tax, and invoicing lures to target organizations across East Asia, Europe, and Africa. The group combines DLL sideloading, cloud hosting, trusted tools like AnyDesk and...

TA4922, a suspected China aligned cybercrime group, is targeting UK and European organisations with tax, payroll and benefits themed malware campaigns.

TA4922 is a Chinese-speaking cybercrime group that has expanded its operations across Asia, Europe, and South Africa by using social engineering, phishing, and multiple malware families to gain access to victim organizations. Proofpoint says the group is financially motivated and has used tools like Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT in...

Key Findings: TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal. The group has been

Proofpoint says Chinese cybercrime group TA4922 is using AI-assisted phishing and apparently LLM-developed malware, including new loader families and remote access

At a Glance Malware family PackClient (RAT / C2 framework) Threat actor TA4922 (Chinese-speaking) - confirmed attribution by Proofpoint Targets Organizations in mainland China and India Delivery vector Tax-themed phishing emails with ZIP or IMG attachments Key capabilities Data theft, keylogging, screen capture, webcam, proxy tunneling, plugin loading Source Proofpoint Threat Insight TL;DR Proofpoint discovered a new remote access trojan named PackClient that is sold on Telegram.

Proofpointが観測、TelegramでRAT「PackClient」が販売され、TA4922が使用中国とインドで税務当局を騙るメールを送りつけ、PackClientのインストーラーを配布高度な機能を備えたRAT、研究者はアジア圏を超えた拡散を警告中国のハッカーたちが、ここ約3カ月にわたり、高度なリモートア

Chinese threat group TA4922 deployed the PackClient RAT framework across China and India via tax-themed phishing between May and July 2026. The malware, purchased as a commercial kit on Chinese-language Telegram marketplaces, features over 60 commands, dual C2 channels, and a plugin architecture — c

中国語話者の脅威アクターTA4922が、中国本土とインドの組織を標的とした税金をテーマにしたフィッシングキャンペーンを通じて、リモートアクセス型トロイの木馬「PackClient」を展開していることが分かりました。 Proofpointが2026年5月と7月に観測したこの活動は、同グループの初期アクセス能力の拡大と、