Proofpoint: TA4922 Deploys New RAT and Loader Arsenal

Gbhackers •Mayura Kathir • June 4, 2026

A rapidly evolving threat cluster tracked as TA4922, a Chinese-speaking cybercriminal actor deploying a diverse and expanding malware arsenal that now includes Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT. The group is notable for its high operational tempo, shifting tactics, and ability to blend custom malware with legitimate tools and cloud services, complicating detection efforts across […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TA4922 Cybercrime Group Expands Malware Arsenal with New RATs and Loaders The cybercriminal group TA4922, identified as Chinese-speaking, has been deploying an expanding range of malware including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT. These campaigns are financially motivated and target organizations across Japan, the UK, Germany, and Southeast Asia. The group's operational tempo is high, with tactics that blend custom malware with legitimate tools, complicating detection efforts. The attacks are characterized by their sophisticated planning and execution, raising alarms within the global security community. Current status indicates ongoing campaigns with no immediate resolution. 3 sources 61

Proofpoint: TA4922 Deploys New RAT and Loader Arsenal

The full story

Extracted Entities

Attack Types (1)

Malware (4)