TA4922 is a Chinese-speaking, financially driven cybercrime group that uses HR, payroll, tax, and invoicing themes to deliver credential-phishing pages, fraud schemes, and remote access malware. In 2025 and 2026, the group expanded beyond East Asia into Europe and Africa, deploying custom loaders such as Atlas RAT, RomulusLoader, and SilentRunLoader. Its campaigns commonly use malicious ZIP or RAR archives hosted on file-sharing platforms and rely on DLL sideloading to install the final payloads. The operation also uses a network of compromised domains and IP addresses to host loader components and command-and-control infrastructure.
Proofpoint tracked several campaigns between March and April 2026 that delivered Atlas RAT, RomulusLoader, and SilentRunLoader through services such as GoFile, MediaFire, and similar hosting platforms. Malware analysis revealed custom PE loaders, DLL sideloading routines, abuse of legitimate remote management tools like AnyDesk, and command-and-control communications over non-standard ports. Investigators identified traffic to 206.238.115.58 , 154.211.86.110 , 43.156.77.97 , and 103.214.172.33 as linked to the group’s C2 infrastructure. They also observed Chrome data exfiltration through ws.ztts88.cyou .
Defenders should enforce application allow-listing, block execution from temporary user directories, monitor writes to sensitive system paths, restrict outbound traffic to unusual ports, and apply least-privilege controls for local user accounts. Detection efforts should focus on DLL sideloading patterns, suspicious process injection behavior, and outbound connections to the identified domains and IP addresses. These measures can help reduce the likelihood of successful infection and limit attacker movement after compromise.
If TA4922 activity is detected, isolate the affected endpoint immediately, terminate suspicious processes, and remove any malicious DLLs or executables from the host. Conduct forensic analysis to uncover persistence mechanisms, including copied binaries placed in paths such as C:\Program Files\Common Files . Block the known malicious domains and IP addresses at the firewall, notify users the phishing lures involved in the campaign, and update detection logic to cover the associated filenames and network indicators.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
The threat actor has already achieved persistence on the victim (e.g., via a Run key – T1546.010) and injected a malicious DLL (T1574.001). The step is to establish a beacon to the C2 server to retrieve further instructions. The actor uses a native Windows binary ( powershell.exe ) to avoid triggering classic malware signatures, sending a simple HTTP GET request to the hard‑coded malicious IP 206.238.115.58 . Because the IP is enumerated in the Sigma rule, this network connection should fire the alert.
Regression Test Script:
Alert Confirmation: Query the SIEM for alerts generated by the rule within the last 5 minutes.
Event Correlation: Verify the underlying Sysmon NetworkConnect event matches the malicious IP.
If both the alert and the corresponding network event appear, the detection rule is functioning as intended.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
