TA4922Threat actor
TA4922 is a Chinese-speaking cybercrime cluster that employs localized HR, payroll, tax, and invoice lures to deliver various malware families, including Atlas RAT, RomulusLoader, and SilentRunLoader. The actor conducts targeted email campaigns, often impersonating trusted authorities, to facilitate credential phishing and fraud.From MISP Galaxy
Last reported 4 days ago, by The Hacker News3 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“The findings indicate how ClickFix is evolving beyond a social engineering technique into a highly effective entry point for malware.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware“However, it shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922), a China-aligned threat actor known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially Ven…”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“TA4922's PackClient: A Chinese-speaking e-crime threat actor is selling access to PackClient, a custom RAT and C2 framework.”
-
Cruciferra Crypter Uses Process Ghosting to Evade Detection“Proofpoint attributed multiple campaigns using the malware to the Chinese-speaking group TA4922, which used tax-themed lures impersonating the Indian Income Tax Department to deliver AsyncRAT via Cruciferra between late April and early June.”
Indicators in its reports
named in the reports above- infosec[.]exchangein 1 report
- hxxps://www.techdirt[.]com/2026/08/26/meta-just-paid-nearly-17-billion-to-make-sure-it-gets-to-write-the-kid-safety-rules-for-every-other-social-media-platform/in 1 report
- www.techdirt[.]comin 1 report
- techdirt[.]comin 1 report
- martinmatishak.bsky[.]socialin 1 report
- esetresearch.bsky[.]socialin 1 report
- 96.62.224[.]81in 1 report
- 86.109.75[.]7in 1 report
- 151.240.151[.]223in 1 report
- 23.94.145[.]224in 1 report
- 93.152.224[.]118in 1 report
- 2.27.248[.]127in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.