Home › Threat Actors › TA4922
← All Threat Actors
Nation-State high China (assessed)

TA4922

Chinese-speaking cybercrime group (financially motivated — not state-sponsored) · Financial — credential theft, data exfiltration, corporate espionage

Reports 1
Active Since 2025
Last Reported 5 Jun 2026
Sectors Targeted finance, professional-services, technology

Tactics, Techniques & Procedures (TTPs)

  • Phishing via tax authority and HR/payroll lure themes — HMRC-branded and "Paperwork.zip" templates documented in UK campaigns
  • ZIP attachment delivery with DLL sideloading — legitimate signed executable bundled with malicious DLL
  • SilentRunLoader: Python-based credential stealer targeting Chrome Login Data, Cookies, and browsing history
  • Atlas RAT: full-featured RAT with keylogging, screen capture, webcam recording, file management, and remote command execution
  • RomulusLoader: deploys AnyDesk and SyncFuture as persistent implants using legitimate signed binaries
  • Out-of-band initial contact via LINE, WhatsApp, and Microsoft Teams before malicious attachment delivery
  • AI-assisted Python malware development — LLM-generated code patterns observed in SilentRunLoader codebase
  • ValleyRAT and Winos4.0 also documented in toolkit

Known Targets

Corporate employees across sectors (non-specific sector targeting)UK organisations (2026 expansion)Germany, Italy, South Africa (2026 European and African expansion)Asia-Pacific organisations (primary historical targeting)

Analyst Notes

Tracked by Proofpoint since spring 2025. Assessed as a Chinese-speaking financially motivated cybercrime group — not a state-sponsored intelligence actor. Carries the highest campaign velocity of any actor currently tracked by Proofpoint. Geographic expansion from Asia-Pacific to UK, Europe, and South Africa documented in early 2026. The two flagship 2026 malware families — SilentRunLoader (Chrome credential/cookie theft) and Atlas RAT (full surveillance RAT) — represent a capability upgrade from earlier toolkit. AI-assisted Python malware development indicates the group is using commercial LLMs to accelerate payload iteration and maintain campaign tempo. Unlike Chinese APT groups, TA4922 is not focused on espionage against government or critical infrastructure — its attack surface is corporate employees across all sectors, and its lure strategy exploits universal trigger events (tax filing, HR/payroll notifications) that affect employees regardless of industry.

Also Known As

TA4922 (Proofpoint designation)

MITRE ATT&CK Techniques

T1566.001 Phishing: Spearphishing Attachment T1574.002 Hijack Execution Flow: DLL Side-Loading T1555.003 Credentials from Password Stores: Credentials from Web Browsers T1113 Screen Capture T1056.001 Input Capture: Keylogging

Intelligence Reports

Briefing financeprofessional-services

TA4922 Extends High-Tempo Campaign Operations to UK and Europe With Atlas RAT and Credential Stealer

Proofpoint has published intelligence on TA4922's geographic expansion into the UK, Germany, Italy, and South Africa — deploying two new malware families via tax-themed and HR-themed phishing. The group holds the highest campaign pace of any Proofpoint-tracked threat actor.

5 Jun 2026 · 5 min read