Proofpoint: TA4922 Deploys New RAT and Loader Arsenal

TA4922 is a Chinese-speaking cybercriminal cluster tracked by Proofpoint that runs high-tempo, financially motivated campaigns using diverse malware (Atlas RAT, RomulusLoader, SilentRunLoader, ValleyRAT), DLL sideloading, and localized HR/tax-themed social engineering to gain persistent remote access, harvest credentials and browsing data, and exfiltrate information across targets in Japan, broader Asia, Europe, and Africa; the report includes detailed TTPs and many IOCs (IPs, URLs, file/ZIP/RAR and executable/DLL hashes).