Sophisticated TA4922 Cybercrime Operations Expand Globally

Proofpoint analysis describes TA4922, a high-tempo Chinese-speaking cybercrime group running widespread financially motivated campaigns that use sophisticated loaders (RomulusLoader), an AI-assisted Python stealer (SilentRunLoader), a modular Atlas RAT, and a heavily modified Winos4.0 to evade detection; operators leverage localized social engineering and shift communications to messaging platforms to extend influence and avoid email gateway visibility.