TA4922: The Suspected Chinese Crime Group is Going Global

TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access.

• Unpacking "Cruciferra": An Analysis of a Sophisticated Crypter ServiceMalware2026-07-20
• Security brief: tax scams aim to steal funds from taxpayersMalware2026-03-30
• Fake Huorong security site infects users with ValleyRATCampaign2026-02-23
• RATatouille: Today's Special: Impersonating Companies in Korea, Payments in CryptocurrencyMalware2026-10-28
• Samsung MagicINFO 9 Server · The Not So Silent Miner: Threat Actor Compiles Cryptominer on the EndpointExploitedMalware2026-09-24