China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

**TA4922 (China-linked)** is a financially motivated cybercrime actor observed by Proofpoint conducting global phishing campaigns targeting organizations in the U.K., Germany, Italy, Japan, Southeast Asia and South Africa; operators deliver RATs and loaders (Atlas RAT, ValleyRAT, RomulusLoader, SilentRunLoader) via DLL side‑loading to steal credentials and browser data, deploy remote access tools (AnyDesk, SyncFuture), and move victims to out‑of‑band messaging to evade defenses.