TA4922 Expands Into Europe With Atlas RAT and New Malware Loaders
Summary
Proofpoint reports that the financially motivated TA4922 group has expanded targeting into Europe and South Africa, using localized phishing and malware including Atlas RAT, RomulusLoader, and SilentRunLoader.
Key points
- Proofpoint says TA4922 has shifted from targeting East Asia to organizations in Germany, Italy, the United Kingdom, and South Africa.
- Lures impersonated payroll, tax, VAT, government, invoice, and human resources communications; the group also contacted targets through messaging platforms.
- Atlas RAT can steal files, log keystrokes, capture screenshots and audio or video, and download plugins or payloads.
- RomulusLoader uses process hollowing, shellcode injection, or direct execution to launch payloads, including remote management tools.
- SilentRunLoader can steal Chrome credentials, cookies, and browsing data; the group also deployed ValleyRAT, tracked by Proofpoint as Winos4.0.
- Proofpoint suggests AI-assisted development may have accelerated malware creation, citing placeholder values, code comments, and patterns associated with AI-generated code.
Article Details
- Event Type
- Cybercrime campaign involving phishing and deployment of previously undocumented malware
- Impact
- Proofpoint reports that TA4922 has expanded from prior targeting in East Asia to organizations in Germany, Italy, the United Kingdom, and South Africa. The financially motivated activity is associated with attempts to breach networks for fraud, data theft, and sale of access. Reported malware capabilities include credential and browser-data theft, surveillance, keylogging, and remote access; the article does not report a measured victim impact.
MITRE ATT&CK
T1005 · Data from Local SystemAtlas RAT supports targeted file theft.T1055.002 · Portable Executable InjectionRomulusLoader was reported to use shellcode injection.T1055.012 · Process HollowingRomulusLoader was reported to deploy payloads using process hollowing.T1056.001 · KeyloggingAtlas RAT includes keylogging capability.T1082 · System Information DiscoveryAtlas RAT performs system reconnaissance.T1105 · Ingress Tool TransferRomulusLoader downloads and executes additional payloads.T1113 · Screen CaptureAtlas RAT can capture screenshots.T1123 · Audio CaptureAtlas RAT can record audio.T1125 · Video CaptureAtlas RAT can record webcam video.T1539 · Steal Web Session CookieSilentRunLoader steals browser cookies.T1555.003 · Credentials from Web BrowsersSilentRunLoader steals Google Chrome credentials.T1566 · PhishingTA4922 used localized phishing lures impersonating payroll, tax, VAT, government, invoice, and HR communications.
Threat Actors
Malware
Atlas RATA Chinese-speaking cybercrime group tracked as TA4922 has expanded operations into Europe, using new malware such as Atlas RAT, RomulusLoader, and SilentRunLoader alongside localized phishing lures.RomulusLoaderA Chinese-speaking cybercrime group tracked as TA4922 has expanded operations into Europe, using new malware such as Atlas RAT, RomulusLoader, and SilentRunLoader alongside localized phishing lures.SilentRunLoaderA Chinese-speaking cybercrime group tracked as TA4922 has expanded operations into Europe, using new malware such as Atlas RAT, RomulusLoader, and SilentRunLoader alongside localized phishing lures.ValleyRAT#TA4922Winos4.0Finally, the researchers spotted the deployment of Winos4.0, a previously documented malware family that Proofpoint tracks as ValleyRAT and which provides operators with a full set of remote access features.
Products
Google ChromeProofpoint also identified a Python-based loader and information stealer called SilentRunLoader, which steals from Google Chrome credentials, cookies, and browsing data.LineThe threat group also attempts to contact victims via WhatsApp, the LINE messenger, and Microsoft Teams.Microsoft Defender Application GuardThe malware features several anti-sandbox and anti-analysis checks, including looking for usernames and registry keys associated with Microsoft Defender Application Guard, the “CExecSvc” service, and OS UUID.Microsoft TeamsThe threat group also attempts to contact victims via WhatsApp, the LINE messenger, and Microsoft Teams.WhatsAppThe threat group also attempts to contact victims via WhatsApp, the LINE messenger, and Microsoft Teams.
Tools
AnyDeskRomulusLoader was deployed to launch legitimate remote management tools such as AnyDesk and SyncFuture, a remote monitoring software tool popular in China.SyncFutureRomulusLoader was deployed to launch legitimate remote management tools such as AnyDesk and SyncFuture, a remote monitoring software tool popular in China.
Countries
GermanyTA4922 has previously targeted organizations in East Asia, but recent campaigns have focused on entities in Germany, Italy, the United Kingdom, and South Africa.ItalyTA4922 has previously targeted organizations in East Asia, but recent campaigns have focused on entities in Germany, Italy, the United Kingdom, and South Africa.South AfricaTA4922 has shifted targeting from East Asia to Europe and South Africa.United KingdomTA4922 has previously targeted organizations in East Asia, but recent campaigns have focused on entities in Germany, Italy, the United Kingdom, and South Africa.