TA4922: The Suspected Chinese Crime Group is Going Global
Essential information
- Published
- 03/06/2026 14:55
- Modified
- 04/06/2026 08:40
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- atlas rat romulusloader silentrunloader ta4922 valleyrat
- Tags
- 2026-06-03 atlas rat romulusloader silentrunloader ta4922 valleyrat
- Related entities
- 23 indicators, 23 observables, 1 intrusion sets (apt), 23 techniques (mitre), 8 malware, 13 others
Description
TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access.