A suspected China-aligned cybercrime group tracked as TA4922, previously known for targeting organisations in East Asia, is now running campaigns against organisations in the UK, Germany, Italy, and South Africa.
Proofpoint researchers said the group has increased its attacks in recent months, using familiar phishing tactics with a growing set of malware tools. The activity includes credential theft, fraud attempts, remote access malware, and the use of legitimate remote management software to help maintain access inside victim networks.
Targeting UK Organisations
For UK organisations, the most relevant activity involves emails designed to look like routine government or business communications. One campaign impersonated tax authorities and referenced VAT filings, payroll tax documents, and regulatory compliance. Another used benefits and compliance-themed messages that copied the language of government and universal benefits services.
Those lures, according to researchers, were not generic spam as they were written around local business processes that employees already deal with, such as tax paperwork, HR notices, salary files, invoices, and compliance requests. That approach gives attackers a better chance of getting a recipient to open a file, click a link, or move the conversation to another channel.
Proofpoint said TA4922 has historically targeted Japan and other parts of Asia, including Taiwan, Korea, Singapore, and India. The newer activity suggests the group is testing a wider victim pool, with European and African organisations now appearing in its campaigns.
Updated Malware Kit
The group’s malware toolkit has also grown. Proofpoint reported the use of variants of ValleyRAT, also known as Winos4.0, Atlas RAT, RomulusLoader, and SilentRunLoader. Each tool plays a different role, from gaining remote access to loading further payloads or stealing browser data.
SilentRunLoader, a newer Python-based stealer and loader, was likely developed with help from large language models (LLMs). It is one of the more notable additions to TA4922’s toolkit because it targets data stored in Google Chrome. Proofpoint said the malware can collect stored credentials, cookies, and browsing information before sending the data to attacker-controlled infrastructure.
In the UK tax-themed campaign, the malware was hosted through MediaFire and delivered through links embedded in emails.
TA4922 has also used DLL sideloading, a technique where a malicious file is loaded by a legitimate executable. For a victim, the file may appear to be part of a normal document package or business application. In practice, it can start malware while making the activity harder to spot during routine scans.
Another part of the group’s modus operandi is the use of legitimate remote management tools such as AnyDesk and SyncFuture. These products have valid business uses, but attackers can abuse them after gaining access, giving them a way to control systems while their activity appears less obviously malicious.
Proofpoint also assessed with high confidence that some of TA4922’s newer Python malware was likely developed with help from large language models. Researchers pointed to code comments, strings, and unchanged placeholder values as signs that the actor may be using AI tools to produce malware faster.
Financially Motivated Attacks
Proofpoint’s report, shared with Hackread.com, states that the actor appears financially motivated, with activity aimed at remote access, data theft, fraud, access resale, or persistent access. Some of TA4922’s tools have similarities with those used in espionage cases, but Proofpoint is treating the group as a separate cybercrime operation.
The research also adds TA4922 to the growing list of financially motivated groups using a mix of malware, phishing, trusted services, and AI-assisted development. The group’s move into the UK and other regions shows that campaigns once concentrated in East Asia are now becoming a direct concern for more international organisations.
Nevertheless, organisations must beware of administrative-themed cyber attacks where tax filings, payroll documents, benefits notices, and compliance requests may sound ordinary at first but make them a useful cover for attackers. That’s why employee cybersecurity training is a must.
