TA4922: The Suspected Chinese Crime Group is Going Global

216.73.217.22

TA4922: The Suspected Chinese Crime Group is Going Global

· Published 03/06/2026 14:55 · Modified 04/06/2026 08:40

Essential information

Published: 03/06/2026 14:55
Modified: 04/06/2026 08:40
Source / Author: AlienVault
Confidence: 100/100
Report type(s): threat-report
Labels / Tags: atlas rat romulusloader silentrunloader ta4922 valleyrat
Tags: 2026-06-03 atlas rat romulusloader silentrunloader ta4922 valleyrat
Related entities: 23 indicators, 23 observables, 1 intrusion sets (apt), 23 techniques (mitre), 8 malware, 13 others

Description

TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access.