TA4922 Campaigns Expand Into Europe and Africa, Investigation Finds

Summary

An investigation of TA4922 infrastructure reports 36 IP addresses possibly belonging to victims communicating with tracked IPs, along with additional malicious-domain findings. The authors assess one subdomain as potentially malicious and possibly a C2 endpoint.

Key points

The article says TA4922 used Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), and expanded campaigns into parts of Europe and Africa.
Proofpoint identified seven network indicators; the authors added a domain found through a subdomain indicator, bringing their investigation to eight indicators: five IP addresses, two domains, and one subdomain.
Sample network data showed 36 unique IP addresses, possibly belonging to victims across 12 ASNs, communicating with two tracked IPs between December 26, 2025, and April 12, 2026.
The investigation identified 2,779 email-connected domains, 39 described as confirmed malicious, and 37 IP-connected domains, 18 described as confirmed malicious.
The authors assessed ws[.]ztts88[.]cyou as potentially malicious and possibly a C2 endpoint; they recommend treating hosts that contacted it as potentially compromised.
Historical DNS data included 268 resolutions for nwphotoblog[.]com from 2017 to 2026; the article presents infrastructure overlap as an investigation finding, not proof of compromise.

Article Details

Event Type: Threat intelligence investigation into TA4922 campaign infrastructure and activity
Impact: TA4922 reportedly expanded campaigns into additional countries in Europe and Africa and used Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0). The investigation identified campaign-related network indicators and reported 36 unique IP addresses likely belonging to victims that communicated with two tracked IP indicators. It also found 2,779 email-connected domains, including 39 described as confirmed malicious, and 37 IP-connected domains, including 18 described as confirmed malicious. The article cautions that entities identified as threats may later be deemed harmless after further investigation.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`nwphotoblog[.]com`	Campaign-related domain IoC described alongside malicious infrastructure; the investigation reports 268 historical domain-to-IP resolutions.
HOSTNAME	`ws[.]ztts88[.]cyou`	Subdomain IoC assessed as likely malicious infrastructure and possibly a C2 endpoint; the article advises treating hosts that contacted it as potentially compromised.
IPV4	`18[.]139[.]83[.]110`	One of five tracked campaign IP IoCs; the investigation reports 114 historical IP-to-domain resolutions for this address.

Threat Actors

TA4922The article identifies TA4922 as a cybercriminal group and attributes campaigns using multiple malware families and expanding into additional countries in Europe and Africa to the group.

Malware

Atlas RATTA4922 is a highly sophisticated cybercriminal group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe RomulusLoaderTA4922 is a highly sophisticated cybercriminal group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe SilentRunLoaderis a highly sophisticated cybercriminal group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe and ValleyRATcybercriminal group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe and Africa.Winos4.0group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe and Africa.