# TA4922 Deploys PackClient RAT via Tax-Themed Phishing Against Organizations in China and India

> Chinese-speaking threat actor TA4922 is distributing a Telegram-marketed C2 framework called PackClient (PackClientLauncher + PackClientCore) through tax-authority phishing lures impersonating the Shandong Provincial Tax Bureau (China) and the Indian Income Tax Department (Hindi-language, India). The India variant uses IMG disk images and DLL side-loading, and at least one intrusion progressed to deployment of ManageEngine RMM software for follow-on access.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-10-24T15:18:07.021Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2202
- **ID:** TL-2026-2202
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA4922 (China)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TA4922 is a Chinese-speaking threat group first observed by Proofpoint in spring 2025 targeting East Asia (primarily Japan) with regionalized HR/payroll/tax-themed phishing, later expanding into Europe and South Africa. The group is a customer of multiple commodity malware families sold through Chinese-language Telegram channels rather than a developer of bespoke tooling, and has previously been linked to Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT/Winos4.0.

In this campaign, TA4922 delivers PackClient, a modular C2 framework advertised on Telegram offering remote control, AV/Defender bypass, keylogging, and UAC-bypass features. PackClient is built in stages: a small initial downloader checks for elevated privileges, drops a DLL (e.g. xMain.dll) and launches it via `rundll32.exe "path\xMain.dll",XMain [URL] [C2_IP] [port]`; that DLL retrieves and XOR-decrypts an encrypted payload, writes it to `%TEMP%\svchost.exe`, and sets RunOnce registry persistence. The next stage, PackClientLauncher, contacts a C2 server over raw TCP to download PackClientCore and reflectively loads it into memory; it also spawns a `--guard` watchdog process that restarts the core module if killed. PackClientCore is the full RAT, supporting 60+ operator commands over two simultaneous, independently configured C2 channels (S1/S2), including shell execution, file management, process/security-product enumeration (with particular interest in Telegram Desktop and WeChat), screen and webcam capture, keylogging, clipboard capture, and a downloadable plugin system (screen control, file manager, remote terminal, proxy/SOCKS tunneling, and suspected browser-credential and Telegram-interception plugins). Configuration is persisted under `HKCU\SOFTWARE\PackClientConsole\`.

The first observed wave (late May 2026) targeted organizations with mainland China operations via emails impersonating the Shandong Provincial Tax Bureau, alleging missed stamp-duty payments and demanding self-inspection; the payload (`数据资料.zip` → `资料数据.exe`) was hosted on the actor-registered domain gov12366[.]com and an HFS (Rejetto HTTP File Server) instance at 154.36.188[.]98:8080, with C2 at 206.238.196[.]96:6666. A second wave beginning mid-July 2026 targeted organizations in India with Hindi-language emails impersonating the Indian Income Tax Department, alleging underreported income or undisclosed foreign assets. This chain delivers a ZIP containing an IMG disk image; mounting the IMG exposes a legitimate-looking executable alongside a malicious DLL (e.g. disguised as `nvdahelperremote.dll`), which is side-loaded to run a Donut Loader that in turn installs PackClient. In at least one India intrusion, ManageEngine remote monitoring and management software was installed a few hours after initial compromise, indicating a path toward broader remote access and potential follow-on operations (data theft, fraud, or access resale) beyond the initial RAT foothold; no ransomware deployment has been confirmed in current reporting. Proofpoint assesses TA4922 as Chinese-speaking/East-Asia-based on Chinese-language sample metadata, Chinese-provider infrastructure, and ecosystem overlap with the Silver Fox/Void Arachne malware-as-a-service community; this is a linguistic/infrastructure attribution, not a confirmed nation-state designation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1218 System Binary Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1112 Modify Registry
- T1555 Credentials from Password Stores
- T1057 Process Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1125 Video Capture
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1036 Masquerading
- T1115 Clipboard Data
- T1105 Ingress Tool Transfer
- T1095 Non-Application Layer Protocol
- T1090 Proxy

## Sources

- [Chinese Hackers Deploy PackClient RAT](https://gbhackers.com/chinese-hackers-deploy-packclient-rat/)
- [Carry-On Compromise: TA4922 Packs PackClient](https://www.proofpoint.com/us/blog/threat-insight/carry-compromise-ta4922-packs-packclient)
- [TA4922: The Suspected Chinese Crime Group is Going Global](https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global)
- [Proofpoint: TA4922 Deploys New RAT and Loader Arsenal](https://gbhackers.com/ta4922-deploys-new-rat/)
- [TA4922 uses PackClient malware in tax phishing attacks](https://itbrief.co.nz/story/ta4922-uses-packclient-malware-in-tax-phishing-attacks)
- [Chinese-Speaking TA4922 Bought New RAT from Commodity Marketplaces](https://www.bankinfosecurity.com/chinese-speaking-ta4922-bought-new-rat-from-commodity-marketplaces-a-32670)
- [PackClient RAT - Malware removal instructions](https://www.pcrisk.com/removal-guides/35810-packclient-rat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2202