Proofpoint: TA4922 Deploys New RAT and Loader Arsenal

A rapidly evolving threat cluster tracked as TA4922, a Chinese-speaking cybercriminal actor deploying a diverse and expanding malware arsenal that now includes Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT.

The group is notable for its high operational tempo, shifting tactics, and ability to blend custom malware with legitimate tools and cloud services, complicating detection efforts across enterprise environments.

Recent campaigns show a clear increase in both scale and sophistication, with attacks leveraging localized social engineering lures themed around human resources, payroll, taxation, and invoicing.

These lures are carefully adapted to regional language and business norms, increasing their success rate.

Proofpoint assesses that TA4922 is financially motivated, focusing on gaining remote access to victim systems for data theft, credential harvesting, fraud, or access resale.

Unlike traditional cybercriminal groups, TA4922 frequently runs overlapping operations with multiple objectives, combining phishing, malware delivery, and social engineering within the same campaign.

A defining characteristic of TA4922 is its use of multiple malware families within short timeframes. Atlas RAT, one of the primary payloads, is delivered via DLL sideloading through malicious ZIP archives hosted on platforms such as GoFile.

Campaigns mostly target organizations in Japan, with additional targeting in Asia including Taiwan, Korea, Singapore, and India. In recent months, the actor expanded global targeting to include European organizations in the U.K., Germany, Italy, and South Africa.

Campaigns observed in March and April 2026 used HR-themed emails to trick victims into executing files that ultimately connect to command-and-control servers over TCP port 886.

Proofpoint said in a report shared with GBhackers, TA4922 has been active since at least spring 2025, initially targeting organizations across East Asia, particularly Japan, before expanding operations into Europe and Africa in 2026.

The malware provides persistent remote access and supports modular plugin-based functionality.

RomulusLoader represents a newly identified loader family used to stage additional payloads. Delivered through similar social engineering techniques, it uses DLL sideloading and advanced execution methods including process injection and encrypted payload delivery.

Once executed, it establishes persistence, injects into processes such as svchost.exe, and communicates with command-and-control infrastructure to retrieve secondary payloads.

TA4922 Deploys New RAT

Notably, TA4922 uses RomulusLoader to deploy legitimate remote management tools like AnyDesk and SyncFuture, allowing attackers to blend malicious activity with normal administrative traffic.

The URLs led to ZIP files hosted on GoFile with filenames such as “Paperwork.zip” and “HR (2).zip”. They contained an executable with a malicious DLL file, libcef.dll. Execution triggered DLL sideloading and resulted in the deployment of Atlas RAT.

SilentRunLoader, another newly observed payload, is a Python-based loader and stealer designed to harvest sensitive data from Google Chrome.

It exfiltrates credentials, cookies, and browsing data via HTTP POST requests to attacker-controlled infrastructure. Analysis indicates the malware may be partially generated using large language models, as evidenced by placeholder API keys and simplistic code structure.

The SyncFuture campaign targeted organizations in Germany and impersonated the Munich tax authority (Finanzamt München). Messages purported to claim the target was receiving a tax audit.

SilentRunLoader was installed via DLL sideloading and exfiltrated Chrome data to previously observed C2 infrastructure hosted at “ws[.]ztts88[.]cyou” which resolved to IP address 18[.]139[.]83[.]110. 

This suggests TA4922 is leveraging automated development techniques to rapidly produce new malware variants.

In addition to malware deployment, TA4922 frequently attempts to move communication خارج traditional email channels. Campaigns often instruct victims to continue conversations via platforms such as LINE, WhatsApp, or Microsoft Teams.

This tactic reduces visibility for email-based security controls and enables more effective social engineering.

The actor shows infrastructure and tooling overlaps with clusters known as Silver Fox or Void Arachne, though Proofpoint tracks TA4922 as a distinct entity.

Its consistent use of Chinese-language artifacts, regional targeting patterns, and infrastructure linked to Chinese providers further supports attribution to a Chinese-speaking ecosystem.

Overall, TA4922 exemplifies a new generation of cybercriminal operations that combine advanced tradecraft with flexible, fast-evolving malware development.

Its ability to rotate payloads, exploit legitimate tools, and scale globally makes it a significant threat to organizations across multiple sectors.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.