Threats Tagged 'romulusloader'

TA4922 is a sophisticated Chinese-speaking cybercrime group that has expanded its operations from East Asia to Europe and Africa. The group uses multiple malware families such as Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT, along with legitimate remote management tools like AnyDesk and SyncFuture. Their campaigns employ localized phishing lures themed around HR, payroll, tax, and invoicing to target large numbers of recipients. TA4922 conducts credential phishing, credit card fraud, and attempts to move communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. They leverage legitimate cloud hosting and trusted software for delivery and persistence, focusing on financial gain through data theft, fraud, and resale of access. No known exploits in the wild or patches are applicable as this is an actor-based threat rather than a software vulnerability. The severity is assessed as medium based on the described impact and operational scope.

MediumMalwareBritish Indian Ocean TerritoryGermanyIndia+7#romulusloader#atlas rat#ta4922