{
  "name": "TA4922: The Suspected Chinese Crime Group is Going Global",
  "slug": "ta4922-the-suspected-chinese-crime-group-is-going-global",
  "description": "TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access.",
  "published": "2026-06-03T12:55:39.682000+00:00",
  "created_at": "2026-06-04T08:40:09.312000+00:00",
  "modified_at": "2026-06-04T06:40:09+00:00",
  "created_at_opencti": "2026-06-04T08:40:09.312000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "atlas rat",
    "romulusloader",
    "silentrunloader",
    "ta4922",
    "valleyrat"
  ],
  "tags": [
    "2026-06-03",
    "atlas rat",
    "romulusloader",
    "silentrunloader",
    "ta4922",
    "valleyrat"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "3adf5953-6c54-4bba-9a7b-d8e4dde6983f",
        "name": "a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295"
      },
      {
        "id": "84583d94-264d-413f-b417-018f614dc7f2",
        "name": "de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2"
      },
      {
        "id": "ea70bd4d-ae85-4e6c-b514-0375ed295d00",
        "name": "3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d"
      },
      {
        "id": "2d489c2b-eacd-4e3d-9ab8-2e5187f1ab32",
        "name": "8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0"
      },
      {
        "id": "a0d980a2-ce16-4487-98ff-79259a987837",
        "name": "314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef"
      },
      {
        "id": "98944ed5-ab08-41d6-9703-2ede800c7df7",
        "name": "9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73"
      },
      {
        "id": "5619b9d4-a1d5-40c1-923c-fb49c00b7ead",
        "name": "40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5"
      },
      {
        "id": "b3574f06-7aeb-49f0-bc5d-c566fcbe2257",
        "name": "https://ws.ztts88.cyou/file/cg.exe"
      },
      {
        "id": "0b241bbb-f2ac-48f1-a726-56e664663f4a",
        "name": "584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8"
      },
      {
        "id": "b8ffd146-f9d5-42a9-921c-0590f2718e0a",
        "name": "e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c"
      },
      {
        "id": "061a9157-8705-4475-92a6-e64fb5bcaff3",
        "name": "4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d"
      },
      {
        "id": "909a7136-44b3-46ea-a499-a635a462b74c",
        "name": "https://nwphotoblog.com"
      },
      {
        "id": "3d304f59-5596-457d-991f-a96112412908",
        "name": "nwphotoblog.com"
      },
      {
        "id": "b38287f0-db6a-4646-a590-753c2450b306",
        "name": "154.211.86.110"
      },
      {
        "id": "8771d324-f90f-412d-afdd-5e69eac66022",
        "name": "https://ws.ztts88.cyou/upload.php"
      },
      {
        "id": "7a815aab-c495-4eac-8926-045f9da015b3",
        "name": "a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad"
      },
      {
        "id": "fb981559-af71-422e-8269-bb3fa8936573",
        "name": "103.214.172.33"
      },
      {
        "id": "a4ffa6fb-a432-4fc7-aae3-f433d6434a70",
        "name": "206.238.115.58"
      },
      {
        "id": "bb49c75a-d56f-4f87-bbce-71c9e1f56208",
        "name": "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d"
      },
      {
        "id": "f3bbc0ed-dbc6-44a4-acf6-6b37b94c7d17",
        "name": "ws.ztts88.cyou"
      },
      {
        "id": "bafb3dfa-d212-459f-8f47-9685d6f62b0d",
        "name": "66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d"
      },
      {
        "id": "75aed2bb-2613-4a2e-96f6-02ab6f937bda",
        "name": "112.121.183.202"
      },
      {
        "id": "873cf1d9-36b7-4a2d-9e66-07b903be35f0",
        "name": "0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8"
      }
    ],
    "intrusion_sets": [
      {
        "id": "75f73d42-b028-4b74-9c87-cdfbdedbdfd0",
        "name": "TA4922",
        "slug": "ta4922"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "02abb0a8-0ebf-433b-987f-e25675af60d6",
        "name": "T1055.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "269fca28-cdea-40b4-ae42-8246ad31a84a",
        "name": "T1125"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "04005df7-339e-4252-906b-09f91499bd52",
        "name": "T1055.003"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "397ed6b1-0142-4167-b0e0-bd69a9adf819",
        "name": "T1566.003"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "436e795b-553f-444e-b837-65818d8f539f",
        "name": "T1119"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "02a5151b-3ae5-4612-8087-fce9e1fa8c3c",
        "name": "HoldingHands",
        "slug": "holdinghands"
      },
      {
        "id": "17695d4d-10e5-4495-be55-b1adfcc8a749",
        "name": "Winos4.0",
        "slug": "winos40"
      },
      {
        "id": "f17bb978-a7e2-4166-83cb-020f45187d45",
        "name": "RomulusLoader",
        "slug": "romulusloader"
      },
      {
        "id": "f8879be0-dea7-4e8d-9aba-78c8ac8c6207",
        "name": "ValleyRAT",
        "slug": "valleyrat"
      },
      {
        "id": "e53adce5-2cdb-44c6-b8a9-84717ee5781a",
        "name": "Atlas RAT",
        "slug": "atlas-rat"
      },
      {
        "id": "9c25d458-6e23-44b3-b663-3c9674620348",
        "name": "SyncFuture",
        "slug": "syncfuture"
      },
      {
        "id": "7193649e-f5a2-4601-8529-3e35ea193839",
        "name": "AnyDesk",
        "slug": "anydesk"
      },
      {
        "id": "3371b1c1-3c48-435b-a06d-50c80702e3e6",
        "name": "SilentRunLoader",
        "slug": "silentrunloader"
      }
    ],
    "observables": [
      {
        "id": "c2c2eada-bf98-4ec1-acc0-32eafc72fe13",
        "name": "nwphotoblog.com"
      },
      {
        "id": "7cabb103-223a-4c8d-b57c-091a7d243a61",
        "name": "ws.ztts88.cyou"
      },
      {
        "id": "23a8be0e-3c94-471c-8343-965a6eb9ab82",
        "name": "103.214.172.33"
      },
      {
        "id": "0354d41b-20ea-4e2a-a491-05df46661cc8",
        "name": "206.238.115.58"
      },
      {
        "id": "e09fa0b7-2fbb-4fa5-a224-7a15025d39f9",
        "name": "112.121.183.202"
      },
      {
        "id": "73bd8fa5-30ec-4e5c-9d96-410b26890319",
        "name": "154.211.86.110"
      },
      {
        "id": "62e1f9ed-15ab-46ff-b391-ff3c787dca34",
        "name": "https://ws.ztts88.cyou/file/cg.exe"
      },
      {
        "id": "cc18ca9b-e64b-4101-a35e-a1578f9eef61",
        "name": "https://ws.ztts88.cyou/upload.php"
      },
      {
        "id": "2e528e32-e2e6-426d-b7ec-0dc8ee25bbb6",
        "name": "https://nwphotoblog.com"
      },
      {
        "id": "",
        "name": "a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295"
      },
      {
        "id": "",
        "name": "de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2"
      },
      {
        "id": "",
        "name": "3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d"
      },
      {
        "id": "",
        "name": "8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0"
      },
      {
        "id": "",
        "name": "314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef"
      },
      {
        "id": "",
        "name": "9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73"
      },
      {
        "id": "",
        "name": "40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5"
      },
      {
        "id": "",
        "name": "584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8"
      },
      {
        "id": "",
        "name": "e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c"
      },
      {
        "id": "",
        "name": "4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d"
      },
      {
        "id": "",
        "name": "a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad"
      },
      {
        "id": "",
        "name": "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d"
      },
      {
        "id": "",
        "name": "66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d"
      },
      {
        "id": "",
        "name": "0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "South Africa"
      },
      {
        "id": "",
        "name": "Japan"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "Malaysia"
      },
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Indonesia"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "nwphotoblog.com"
      },
      {
        "id": "",
        "name": "ws.ztts88.cyou"
      }
    ]
  },
  "external_refs": [
    {
      "id": "f4a8000f-1fb8-47be-8ba6-0e2fb1f882fd",
      "standard_id": "external-reference--3cae5c8a-e221-5278-b9c4-92c76c6dca46",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a20244bdece9b50eee824aa",
      "hash": null,
      "external_id": "6a20244bdece9b50eee824aa",
      "created": "2026-06-04T08:40:06.665Z",
      "modified": "2026-06-04T08:40:06.665Z",
      "createdById": null
    },
    {
      "id": "6ce13dd2-30e3-49be-9b3a-ff9295fb8a16",
      "standard_id": "external-reference--851fff87-f6c1-5fb0-b95c-c657071c151b",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global",
      "hash": null,
      "external_id": null,
      "created": "2026-06-04T08:40:06.711Z",
      "modified": "2026-06-04T08:40:06.711Z",
      "createdById": null
    }
  ]
}