In a June 4, 2026 report, Proofpoint disclosed that the Chinese-speaking cybercrime group TA4922 — previously confined to East Asia — has significantly expanded operations into Europe and South Africa. The group is now deploying three previously undocumented malware families: Atlas RAT (a full-featured remote access trojan), RomulusLoader (a process-hollowing loader), and SilentRunLoader (a Python-based infostealer targeting Chrome). TA4922 also continues to deploy Winos4.0 (tracked by Proofpoint as ValleyRAT).
Proofpoint assesses TA4922 as financially motivated but notes that the malware's capabilities — including surveillance features — could be sold to or shared with espionage groups. Since March 2026, the group has run more unique campaigns than any other tracked cybercrime actor in Proofpoint's dataset. Researchers observed placeholder values and code comment patterns in the malware consistent with LLM-generated code, suggesting the operator is using AI to accelerate development.
No CVEs are involved — this is a direct phishing-to-malware campaign. IOCs including hashes, domains, and file artifacts are published in Proofpoint's full disclosure.
◈ Table of Contents
PHASE 01 — Threat Actor Profile
TA4922| Attribute | Detail |
|---|---|
| Tracked As | TA4922 (Proofpoint) — overlaps with Silver Fox, Void Arachne |
| Origin | Chinese-speaking; assessed financially motivated with potential espionage overlap |
| Activity Surge | Marked increase since March 2026; unprecedented operational diversity since April 2026 |
| Historical Scope | Previously targeted East Asia — now pivoting to Germany, Italy, UK, South Africa |
| Campaign Volume | More unique campaigns than any other tracked cybercrime actor in Proofpoint telemetry |
| LLM Usage | Code placeholder values and comment patterns consistent with LLM-generated code observed in binaries |
| Capability Scope | Financial theft + surveillance; capabilities could be sold to espionage groups |
PHASE 02 — Malware Arsenal
4 FAMILIESAtlas RAT is a previously undocumented remote access trojan. It provides full operator control over compromised systems and includes sophisticated anti-analysis capabilities to resist sandboxing and debugging.
- System shutdown and reboot commands
- Full remote access and command execution
- Anti-sandbox checks: scans for usernames and registry keys associated with Microsoft Defender Application Guard
- Anti-analysis: detects CExecSvc service (sandbox indicator) and OS UUID patterns
- Checks for virtualization artifacts before activating full payload
RomulusLoader is a new malware loader identified in TA4922 campaigns. It downloads and executes additional payloads using three injection methods, enabling flexible post-exploitation payload delivery while evading static detection.
- Process hollowing — spawns a legitimate process and replaces its memory with malicious code
- Shellcode injection — writes and executes shellcode into a target process's memory space
- Direct execution — drops and runs a binary payload on disk with obfuscated path
SilentRunLoader is a Python-based loader and information stealer deployed against targets in the UK and Southeast Asia via government service impersonation lures. It specifically targets Google Chrome for credential, cookie, and browsing data extraction.
- 1Delivery vector: Phishing emails impersonating government services (UK government lures observed)
- 2Credential theft: Extracts saved Chrome passwords, session cookies, and full browsing history
- 3Execution: Python-based — likely compiled to executable via PyInstaller or similar; low AV detection
TA4922 continues deploying Winos4.0, which Proofpoint tracks as ValleyRAT. This previously documented malware family provides operators with a full set of remote access features and has been observed across TA4922's European campaigns alongside the new malware families.
PHASE 03 — Attack Chain
PHISHING TO RATPHASE 04 — Targeting Profile
EUROPE + BEYONDGermany
New European target. Campaigns observed since TA4922's April 2026 expansion. Lure themes likely business or finance-related based on group's financial motivation.
Italy
New European target. Part of the concurrent multi-country European campaign push by TA4922 alongside Germany and UK.
United Kingdom
SilentRunLoader deployed with government service impersonation lures specifically targeting UK organizations. Chrome credential harvesting primary objective.
South Africa
TA4922 expanding beyond Europe into Africa. First observed targeting of South African organizations. Motivation and sector focus not yet disclosed by Proofpoint.
Southeast Asia (ongoing)
Historical TA4922 target region. SilentRunLoader was also deployed against Southeast Asian organizations alongside the UK. East Asian campaigns continue in parallel.
Espionage Risk
Malware capabilities extend beyond financial theft into surveillance. Proofpoint explicitly flags risk of capabilities being sold or transferred to state-sponsored espionage groups.
PHASE 05 — Indicators of Compromise
PROOFPOINT DISCLOSUREProofpoint's full disclosure includes file hashes, C2 domains, and delivery infrastructure for all four malware families. The following are the confirmed observable patterns from the campaign:
| Indicator Type | Detail |
|---|---|
| Malware Families | Atlas RAT, RomulusLoader, SilentRunLoader, Winos4.0 (ValleyRAT) |
| Delivery Method | Phishing emails with malicious attachments; government service impersonation lures |
| Python Loader | SilentRunLoader — Python-based, targets Chrome credentials/cookies/browsing data |
| Anti-Sandbox Artifacts | Checks for CExecSvc service, Microsoft Defender Application Guard registry keys, OS UUID patterns |
| Commit Author (Git) | Not applicable — phishing delivery vector, not supply chain |
| Full IOC List | Available in Proofpoint report (hashes, C2 domains, IP infrastructure) |
PHASE 06 — MITRE ATT&CK Mapping
ENTERPRISE| Technique | ID | Malware / Notes |
|---|---|---|
| Phishing: Spearphishing Attachment | T1566.001 | Government service impersonation lures |
| Process Injection: Process Hollowing | T1055.012 | RomulusLoader |
| Process Injection: Shellcode Injection | T1055.004 | RomulusLoader |
| Credentials from Web Browsers | T1555.003 | SilentRunLoader (Chrome credentials, cookies) |
| Virtualization/Sandbox Evasion | T1497 | Atlas RAT anti-sandbox, anti-analysis checks |
| Remote Access Tools | T1219 | Atlas RAT, Winos4.0/ValleyRAT |
| System Shutdown/Reboot | T1529 | Atlas RAT command capability |
| Masquerading | T1036 | Multiple lure impersonations |
PHASE 07 — Detection Logic
KQLTA4922 campaigns favor phishing over exploitation. Focus email security on government impersonation themes: HMRC (UK), Bundesministerium (DE), INPS (IT). Block Python interpreters from accessing Chrome credential paths as a hardening measure.
PHASE 08 — Sources
PRIMARYCheck TA4922 IOCs against your environment → Use the CyberHawk IOC Scanner to run Atlas RAT and RomulusLoader indicators from the Proofpoint disclosure against your threat intelligence feeds.
🔍 Launch IOC Scanner at cyberhawkthreatintel.com/ioc-scanner →
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."