Loading story…
Proofpoint identified Chinese-speaking threat actor TA4922 delivering the modular PackClient remote-access trojan (RAT) and command-and-control framework through tax-themed phishing. In late May 2026, the actor impersonated the Shandong Provincial Tax Bureau to target organizations in mainland China; in July, it used Hindi-language messages posing as the Indian Income Tax Department against Indian organizations. The Indian lures delivered ZIP archives containing IMG files and used DLL sideloading to install the malware.
PackClient, advertised through Chinese-language Telegram channels, supports dual C2 connections, persistence, process monitoring, screen and webcam capture, keylogging, clipboard theft, proxy tunneling, file and shell operations, and downloadable plugins. Its emergence follows prior reporting on updated ValleyRAT variants, underscoring continued development and distribution of feature-rich RATs within the Chinese-speaking threat ecosystem; PackClient's marketing may also enable adoption by additional actors.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
After a PackClient infection began on 20 July, operators suppressed UAC prompts and installed an attacker-controlled ManageEngine Endpoint Central UEMS agent. The agent enabled Active Directory enumeration, vulnerability scanning, remote control, and deployment of DeviceControl, BitLocker-management, and anti-ransomware/EDR modules.
From 20 to 22 July 2026, TA4922 conducted another India-focused tax-themed campaign using ITDTAX202601987.zip and IMG attachments including Tax_Notice_23709.img. PackClient communicated with 192[.]252[.]180[.]45 over TCP port 6666, and the actor deployed ManageEngine Remote Monitoring and Management software several hours after infection.
In mid-July 2026, TA4922 targeted organizations in India with Hindi-language lures impersonating the Indian Income Tax Department. ZIP archives containing IMG files used DLL sideloading and Donut Loader to install PackClient, with post-compromise communications to 64[.]81[.]30[.]99.
In late May 2026, the Chinese-speaking threat actor TA4922 sent tax-inspection phishing emails impersonating the Shandong Provincial Tax Bureau to organizations operating in mainland China. The campaign directed victims to download 数据资料.zip from gov12366[.]com, which contained an executable that installed PackClient.
TA4922 recently expanded its targeting beyond East Asia to organizations in Europe and the United Kingdom, according to the reference. No specific campaign dates, victims, or technical details for this expansion were provided.
Researchers released detection indicators for PackClient activity associated with TA4922, including gov12366.com, six IP addresses, and ten SHA-256 hashes. The report also described PackClient as a Telegram-sold modular framework capable of data theft, surveillance, and downloading further payloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 38 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecommunity.gurucul.com
Open sourceblog.deception.pro
Open sourceproofpoint.com
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a suspected China-linked phishing campaign targeting Indian taxpayers, tax professionals, and corporate finance teams by impersonating the **Income Tax Department of India**. The operation, tracked as **Operation DragonReturn**, used tax-themed emails to lure victims into opening malicious archives and virtual disk files that triggered multi-stage infections through **DLL side-loading** and hijacking. Observed activity began in mid-May, and investigators said the infrastructure and tradecraft show overlaps with the China-associated group **Silver Fox**. The malware chains ultimately deployed remote access trojans including **DCRat** and **ValleyRat**, along with secondary payloads for screenshots and data exfiltration. Researchers said the intrusions relied on anti-analysis checks, **UAC** elevation, image-based payload concealment, encrypted in-memory execution, **AMSI** bypass, process injection, and persistence via Windows services and the registry. The implants were also capable of downloading additional encrypted modules from command-and-control servers, giving attackers covert, persistent access to victim systems.
Jul 8, 2026
Proofpoint reported that suspected China-linked cybercrime group **TA4922** has expanded beyond its traditional East Asia focus and is now targeting organizations in the **UK, Germany, Italy, South Africa**, and other regions with localized phishing campaigns. The actor has used lures tied to **tax filings, payroll, benefits, invoices, HR notices, and compliance requests** to trick recipients into opening attachments, clicking links, or continuing email conversations, with activity increasing from spring 2025 and intensifying in March and April 2026. The campaigns delivered credential phishing and malware including **`SilentRunLoader`**, **`Atlas RAT`**, **`RomulusLoader`**, and **`Winos4.0`/`ValleyRAT`**. Proofpoint said the group relies on **DLL sideloading**, anti-analysis techniques, process injection, and selective payload delivery, while also abusing legitimate remote-management and file-sharing tools such as **AnyDesk**, **SyncFuture**, **GoFile**, **LimeWire**, and **MediaFire** to blend into normal activity and maintain access. Researchers assessed the actor as primarily **financially motivated**, pursuing credential theft, fraud, data theft, persistence, and access resale, and said code artifacts in the Python-based **`SilentRunLoader`** suggest some malware development may have been assisted by **large language models**.
Aug 11, 2026
The Chinese threat actor known as **Silver Fox** has launched a targeted phishing campaign against Indian organizations, using income tax-themed emails to deliver the modular remote access trojan **ValleyRAT**. Attackers impersonate the Indian Income Tax Department, sending emails with decoy PDF attachments that, when opened, direct victims to a malicious website hosting a ZIP archive. This archive contains a disguised installer that leverages DLL hijacking, specifically abusing a legitimate executable (`thunder.exe`) and a malicious DLL (`libexpat.dll`), to establish persistent access and evade detection. The campaign demonstrates a sophisticated multi-stage infection chain, with the initial payload acting as a loader for subsequent malware modules designed to maintain deep access to compromised systems. Researchers from CloudSEK have attributed this campaign to Silver Fox, correcting previous misattributions to other threat groups. The group, also known as SwimSnake and Void Arachne, has expanded its targeting beyond Chinese-speaking entities to include Indian public, financial, medical, and technology sectors. The use of socially engineered tax documents and trusted file formats highlights the attackers' ability to bypass traditional security controls, while the complex kill chain and modular malware architecture underscore the evolving threat posed by Silver Fox to Indian organizations.
Jun 29, 2026