Proofpoint Reports TA4922 Expanding Campaigns and Malware Use
Summary
Proofpoint says financially motivated group TA4922 has expanded targeting into Europe and South Africa, using social engineering, credential phishing, and malware including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT.
Key points
- Proofpoint says TA4922 has targeted organizations in the UK, Germany, Italy, and South Africa, in addition to prior targets in Asia.
- The group uses HR, payroll tax, invoicing, and customer-service lures to deliver malware or steal credentials.
- Proofpoint observed TA4922 shifting some communications from email to platforms including LINE, WhatsApp, and Microsoft Teams.
- March campaigns targeting Japanese organizations used Atlas RAT and RomulusLoader; April Atlas RAT campaigns targeted organizations in the UK and Germany.
- Some April campaigns used RomulusLoader to install legitimate remote monitoring and management tools, including AnyDesk and SyncFuture.
- Proofpoint says SilentRunLoader was used to exfiltrate Chrome credentials, cookies, and browsing information.
- Proofpoint assesses TA4922 as financially motivated and reports that its malware capabilities could also support surveillance.
Article Details
- Event Type
- Reported financially motivated cybercrime campaigns involving social engineering, credential phishing, malware distribution, and fraud.
- Impact
- Proofpoint reports that TA4922 targets organizations across Asia, Europe, and South Africa to obtain remote access for data theft, access resale, and fraud. Reported activity includes credential phishing and theft of credentials, cookies, and browsing information. Proofpoint assesses the group as financially motivated and says its malware has potential surveillance capabilities that could be used by or sold to espionage groups.
MITRE ATT&CK
Threat Actors
Malware
Atlas RATIn March, the threat actor used HR lures in campaigns targeting organizations in Japan with the Atlas RAT backdoor and the RomulusLoader malware loader.RomulusLoaderIn March, the threat actor used HR lures in campaigns targeting organizations in Japan with the Atlas RAT backdoor and the RomulusLoader malware loader.SilentRunLoaderAt the end of March, the group targeted UK organizations with the SilentRunLoader Python‑based loader and stealer to exfiltrate credentials, cookies, and browsing information from Google Chrome.ValleyRATAccording to Proofpoint, the cybercrime gang has also been observed using the ValleyRAT (Winos4.0) backdoor and other malware families in attacks.Winos4.0According to Proofpoint, the cybercrime gang has also been observed using the ValleyRAT (Winos4.0) backdoor and other malware families in attacks.
Products
AnyDeskMultiple April campaigns attributed to TA4922 relied on RomulusLoader to install legitimate Remote Monitoring and Management (RMM) tools, including AnyDesk and SyncFuture.Google ChromeAt the end of March, the group targeted UK organizations with the SilentRunLoader Python‑based loader and stealer to exfiltrate credentials, cookies, and browsing information from Google Chrome.LineTA4922 was also seen launching credential-phishing and imposter campaigns, looking to shift communication from email to out-of-band channels, including messaging platforms such as LINE, WhatsApp, or Microsoft Teams.Microsoft TeamsTA4922 was also seen launching credential-phishing and imposter campaigns, looking to shift communication from email to out-of-band channels, including messaging platforms such as LINE, WhatsApp, or Microsoft Teams.SyncFutureMultiple April campaigns attributed to TA4922 relied on RomulusLoader to install legitimate Remote Monitoring and Management (RMM) tools, including AnyDesk and SyncFuture.WhatsAppTA4922 was also seen launching credential-phishing and imposter campaigns, looking to shift communication from email to out-of-band channels, including messaging platforms such as LINE, WhatsApp, or Microsoft Teams.
Countries
GermanyRecently, the group also started targeting European organizations in the UK, Germany, and Italy, as well as entities in South Africa.IndiaHistorically, the cybercrime gang has sent hundreds to a few thousand messages per campaign, tailored to specific regions or business functions, targeting organizations in Japan, Taiwan, Korea, Singapore, and India.ItalyRecently, the group also started targeting European organizations in the UK, Germany, and Italy, as well as entities in South Africa.JapanHistorically, the cybercrime gang has sent hundreds to a few thousand messages per campaign, tailored to specific regions or business functions, targeting organizations in Japan, Taiwan, Korea, Singapore, and India.KoreaHistorically, the cybercrime gang has sent hundreds to a few thousand messages per campaign, tailored to specific regions or business functions, targeting organizations in Japan, Taiwan, Korea, Singapore, and India.SingaporeHistorically, the cybercrime gang has sent hundreds to a few thousand messages per campaign, tailored to specific regions or business functions, targeting organizations in Japan, Taiwan, Korea, Singapore, and India.South AfricaRecently, the group also started targeting European organizations in the UK, Germany, and Italy, as well as entities in South Africa.TaiwanHistorically, the cybercrime gang has sent hundreds to a few thousand messages per campaign, tailored to specific regions or business functions, targeting organizations in Japan, Taiwan, Korea, Singapore, and India.United KingdomRecently, the group also started targeting European organizations in the UK, Germany, and Italy, as well as entities in South Africa.