Proofpoint Warns TA4922 Deploys Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT

Cybersecuritynews •Tushar Subhra Dutta • June 4, 2026

A sophisticated cybercrime group known as TA4922 is raising alarms across the global security community. The group has been deploying a growing arsenal of malware, including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT, against organizations in Japan, the United Kingdom, Germany, and across Southeast Asia. These campaigns are financially motivated and show a level of planning […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TA4922 Cybercrime Group Expands Malware Arsenal with New RATs and Loaders The cybercriminal group TA4922, identified as Chinese-speaking, has been deploying an expanding range of malware including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT. These campaigns are financially motivated and target organizations across Japan, the UK, Germany, and Southeast Asia. The group's operational tempo is high, with tactics that blend custom malware with legitimate tools, complicating detection efforts. The attacks are characterized by their sophisticated planning and execution, raising alarms within the global security community. Current status indicates ongoing campaigns with no immediate resolution. 3 sources 61

Extracted Entities

Proofpoint Warns TA4922 Deploys Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (3)

Malware (4)