Proofpoint Warns TA4922 Deploys Atlas RAT and Multiple Malware Loaders

The Chinese-speaking cybercriminal ecosystem is rapidly expanding, with a newly designated threat actor, TA4922, leading the charge.

Recently tracked by Proofpoint, this financially motivated group targets organizations across East Asia and Europe using highly tailored social engineering.

Driven by a fast-paced operational tempo, TA4922 is shifting its tactics, moving away from simple credential phishing to deploying a diverse arsenal of advanced malware, including the newly identified Atlas RAT, RomulusLoader, and SilentRunLoader.

TA4922’s campaigns primarily target organizations in Japan, Taiwan, Germany, and the UK.

Using localized lures that impersonate human resources, tax authorities, or customer service, the group tricks victims into downloading malicious ZIP or IMG files hosted on legitimate file-sharing platforms like GoFile and MediaFire.

TA4922 Deploys Malware Loaders

The cornerstone of recent TA4922 campaigns is Atlas RAT, a fully featured, modular backdoor. Delivered via DLL sideloading within seemingly innocuous attachments, the malware loader performs extensive anti-sandbox checks.

It actively looks for hypervisor DNS suffixes, Windows Defender Application Guard environments, and container execution services before proceeding.

Once the environment is deemed safe, it allocates memory via direct syscalls to execute XOR-decrypted shellcode.

This ultimately downloads a core module from a command-and-control (C2) server to harvest system data, establish persistent access, and deploy surveillance tools like keyloggers and webcam recorders.

In parallel, the group introduced RomulusLoader, a custom C-based loader that abuses legitimate Vulkan Graphics API components.

By sideloading a malicious DLL, RomulusLoader decrypts an embedded payload and injects it into legitimate system processes, such as svchost.exe.

Interestingly, TA4922 uses this loader as a first-stage weapon to deploy legitimate Remote Monitoring and Management (RMM) tools, such as AnyDesk and the Chinese RMM SyncFuture, allowing them to blend seamlessly into enterprise network traffic.

Further demonstrating its rapid development cycle, TA4922 is deploying SilentRunLoader, a Python-based stealer likely generated by a Large Language Model (LLM).

This “vibe-coded” malware specifically targets Google Chrome data, exfiltrating stored credentials and cookies to actor-controlled infrastructure.

The raw Python code even contains untouched LLM placeholder text, underscoring a high-speed, automated approach to malware creation.

To round out their arsenal, the threat actor also relies on heavily modified versions of the Winos4.0 (ValleyRAT) framework.

Recent variants feature a codebase significantly larger than standard versions likely bloated with junk code to evade basic endpoint scanning and fully encrypt their configurations using RC4 keys to mask campaign identifiers.

According to Proofpoint research, TA4922 frequently attempts to move victim interactions out of band. Initial phishing emails often instruct targets to continue conversations on encrypted messaging platforms like LINE or WhatsApp.

This tactic allows threat actors to bypass enterprise email security perimeters and continue social engineering or malware delivery directly to users.

Defending against this rapid evolution requires strict application allowlisting, restricting local admin rights, and actively monitoring executable files running from temporary user directories.

Security teams should monitor the following Indicators of Compromise (IOCs) associated with recent TA4922 campaigns:

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.