TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access.
FortiGuard Labs has traced a hacker group's evolving campaigns across Asia, starting with Winos 4.0 attacks in Taiwan and expanding to Japan and Malaysia. The group employs phishing emails with malicious PDFs and evolving malware delivery tactics. They've shifted from using cloud storage links to custom domains for malware distribution. The latest campaign in Malaysia uses a multi-stage attack flow, leveraging the Windows Task Scheduler for stealth. The malware, identified as HoldingHands, has been updated with new features, including the ability to update C2 IP addresses via registry entries. The attackers have demonstrated adaptability in their techniques while maintaining some consistent patterns, allowing researchers to link seemingly unrelated attacks.
