Winos4.0

Reported Context (6)

group that rapidly shifted between Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0) while expanding campaigns from nearby regions into parts of Europe and Africa. TA4922 Campaigns Expand Into Europe and Africa, Investigation Finds
According to Proofpoint, the cybercrime gang has also been observed using the ValleyRAT (Winos4.0) backdoor and other malware families in attacks. Proofpoint Reports TA4922 Expanding Campaigns and Malware Use
Finally, the researchers spotted the deployment of Winos4.0, a previously documented malware family that Proofpoint tracks as ValleyRAT and which provides operators with a full set of remote access features. TA4922 Expands Into Europe With Atlas RAT and New Malware Loaders
actor that has evolved its toolkit to include Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT/Winos4.0 while using regional HR, payroll, tax, and invoicing lures to target organizations across East Asia, Proofpoint Details TA4922’s Expanding Malware Campaigns
TA4922 (likely East Asia–based) delivers Winos4.0/ValleyRAT ecosystem components, information stealers and fraud efforts, frequently impersonates tax authorities, and requests phone numbers to move communications Proofpoint Reports Over 100 Tax-Themed Campaigns Using RMM Tools and Credential Phishing

Malware (5)

Threat Actors (2)

MITRE ATT&CK (30)

Products (17)

Tools (5)

Industries (1)

Countries (16)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.