China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa
Summary: Proofpoint is tracking a Chinese-speaking cybercrime group it calls TA4922, which has expanded from largely East Asian targeting to organizations in the U.K., Germany, Italy, and South Africa. Its campaigns use HR- and business-themed phishing lures for credential theft and malware delivery, including ValleyRAT (Winos 4.0), Atlas RAT (AtlasCross RAT), and previously undocumented loaders RomulusLoader and SilentRunLoader, and the group pushes conversations to LINE, WhatsApp, and Microsoft Teams to bypass enterprise controls.
Why it matters: Proofpoint assesses TA4922 as financially motivated but notes its malware carries surveillance potential that could be used by or sold to espionage groups - and it describes the actor as running more unique campaigns than any other it tracks, with the ability to add targets at any time.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026