China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa

TA4922, a China-linked cybercriminal group, is rapidly expanding phishing attacks targeting organizations across Europe including the U.K., Germany, Italy, and South Africa.

• •The group deploys multiple malware families including ValleyRAT, Atlas RAT, RomulusLoader, and the previously undocumented SilentRunLoader
• •Phishing campaigns use human resources, business, tax, and invoice-related lures to deliver malware via DLL side-loading
• •Attackers redirect conversations from email to out-of-band channels like LINE, WhatsApp, and Teams to bypass enterprise security controls
• •SilentRunLoader is a Python-based loader that harvests sensitive data from Google Chrome including credentials, cookies, and browsing history
• •The group is financially motivated, seeking remote access for data theft, fraud, and access resale