TA4922 / Atlas RAT — Global Phishing-to-RAT Campaign

TA4922 is a Chinese-speaking, financially motivated cybercrime group that Proofpoint assesses runs more unique campaigns than any other tracked cybercrime threat actor in its telemetry. First tracked in spring 2025 targeting Japan, Taiwan, South Korea, Singapore, India, Malaysia and Indonesia, the group sharply escalated tempo and diversity starting March 2026 and expanded targeting into the United Kingdom, Germany, Italy and South Africa. The attacker's objective is remote access to victim environments for data theft, credential harvesting, fraud, or access resale — not espionage, though the surveillance capability set (webcam, microphone, keylogging) could be resold to actors who are.

The attack chain is consistent across regions: a highly localized phishing lure (HR/payroll notice, tax-authority audit or VAT filing, invoice, or benefits/compliance notice, often pushed to WhatsApp, LINE, or Microsoft Teams to dodge email controls) delivers a ZIP/RAR/IMG archive hosted on GoFile, LimeWire, or MediaFire. Inside, a legitimate-looking executable (e.g. vulkaninfo.exe) sideloads a malicious DLL (vulkan-1.dll, libcef.dll, teamspeak_control.dll) that decrypts and runs a payload in memory — most often the newly documented Atlas RAT, but also RomulusLoader, SilentRunLoader, or Winos4.0/ValleyRAT. Atlas RAT performs extensive anti-sandbox checks before beaconing to actor-controlled C2 over non-standard TCP ports (confirmed: 886, 1234), and its full capability set includes reconnaissance, file theft, keylogging, screenshot/webcam/audio capture, and plugin loading.

The single highest-value defensive angle is the DLL-sideload execution moment itself (Section 8, Q1) — it is the one point in the chain common to every payload family in this arsenal, it is cheap to detect, and it has near-zero false-positive rate once the legitimate installation paths are excluded. The second highest-value angle is the confirmed C2 infrastructure (Section 8, Q2), independently corroborated across three sources for the flagship IP:port pair.

Defender priority: deploy Q1 (DLL-sideload pair execution) and Q2 (known C2 IP/port) as Custom IOAs this week — see Section 9 — before investing in the lower-confidence behavioral queries. Treat the published C2 infrastructure as perishable; this report is dated 2026-09-10, roughly three months after the June 2026 Proofpoint disclosure, so revalidate IPs before hard-blocking.

Six sources were fetched directly for this pack; verbatim snapshots are saved in TA4922-Atlas-RAT-Hunt-sources/ for provenance validation. One additional outlet (Dark Reading) returned HTTP 403 on fetch and is listed for corroboration-of-existence only — no indicator in this pack depends on it.

Cross-reference & provenance decisions

• C2 IP 206.238.115.58, port 886 — corroborated by three independent sources (Proofpoint primary, SOC Prime, Cyber Security News). Shipped as a hard atomic IOC per the two-source-minimum rule.
• File hashes (all 14) — published only by Proofpoint's own malware analysis (expected: vendor-derived hash lists are not typically re-published verbatim by press outlets). Shipped as high-confidence vendor-attributed IOCs, traceable to 01-proofpoint-blog.txt.
• C2 IP 18.139.83.110 (SilentRunLoader) and landing-page domain nwphotoblog[.]com — single-sourced to Proofpoint primary only; neither SOC Prime nor Cyber Security News republished them. Shipped, but confidence marked medium in the IOC table rather than high.
• Domain aeya388[.]club — single-sourced to Cyber Security News (T2) only; not in the Proofpoint primary text extracted, not in SOC Prime. Shipped as a lower-confidence hunting lead (action: hunt, not detect) per the confidence vocabulary in Section 10, and flagged again in Q8's FP note.
• Dark Reading — fetch blocked (HTTP 403). Retained in References (Section 18) as a corroborating outlet by title/URL only; contributes no indicator.

Hunt hypotheses (ordered by fidelity)

Attack chain

Known gap: process-injection into svchost.exe/dllhost.exe (RomulusLoader step) is not reliably observable from the standard Falcon field set alone — Falcon does not publish a documented CreateRemoteThread-equivalent field for this. See Section 15 for the coverage-map treatment and Section 7 for a Sysmon-based supplement.

File hashes (SHA256)

Network indicators

Host indicators

Non-CQL checks that cover the gaps flagged in Sections 5 and 6, or that give an environment without Falcon coverage a starting point.

• Mail gateway / Exchange Online: external-sender messages with subject-line keywords matching payroll/salary/tax/VAT/invoice/compliance terms (localized per target language) AND a ZIP/RAR/IMG attachment or a link to gofile.io, mediafire.com, or limewire.com. Flag especially when the message body directs the reader to continue the conversation on WhatsApp, LINE, or Teams — that pivot-off-email instruction is itself a strong signal per the primary source.
• Sysmon Event ID 7 (Image Loaded): module load of vulkan-1.dll, libcef.dll, or teamspeak_control.dll into a process whose parent image is not the expected legitimate installer tree — supplements Q1 on hosts without Falcon.
• Sysmon Event ID 8 (CreateRemoteThread) / Event ID 10 (ProcessAccess): target process svchost.exe or dllhost.exe with a source process that is not a standard Windows service host or the SCM — the closest native substitute for the process-injection telemetry gap noted in Sections 5 and 15.
• Sysmon Event ID 3 (Network Connect): destination port 886 or 1234 to a non-RFC1918 address — network-layer supplement to Q3 on non-Falcon hosts.
• Windows Security Event 4688 (Process Creation): AnyDesk.exe or SyncFuture.exe with a CreatorProcessName or CommandLine path under \Temp\, \AppData\, or \Downloads\ — supplements Q6.
• Proxy / SWG logs: download from gofile.io, mediafire.com, or limewire.com followed within minutes by execution of a file from the browser download directory — the download-to-execution correlation Falcon alone does not directly express as a single event.
• Registry audit (native, non-Falcon): presence of a "WDAG"-named RunOnce or Run key value — no full registry path was published by any source, so treat this as a keyword hunt over exported registry hives (reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /s | findstr /i wdag) rather than a live-query target.

Promote to Custom IOA

Investigate-only (do not auto-block)

Q3, Q4, Q5, Q6, Q7, and Q8 carry medium FP risk and depend on correlation with Q1/Q2 to reach alerting confidence. Run as scheduled searches feeding a triage queue, not as blocking IOAs, until a tuning pass against your own environment's baseline reduces the noted FP sources to near-zero.

type,value,action,severity,expiration,description,tags
sha256,a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295,prevent,critical,2027-03-10,Atlas RAT payload PE,campaign:TA4922
sha256,584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8,prevent,critical,2027-03-10,Atlas RAT sideload DLL,campaign:TA4922
sha256,66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d,prevent,high,2027-03-10,TA4922 Paperwork.zip archive,campaign:TA4922
sha256,4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d,prevent,high,2027-03-10,TA4922 HR (2).zip archive,campaign:TA4922
sha256,a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad,prevent,critical,2027-03-10,Atlas RAT libcef.dll sideload DLL,campaign:TA4922
sha256,40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5,prevent,high,2027-03-10,RomulusLoader RAR archive,campaign:TA4922
sha256,8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0,prevent,critical,2027-03-10,RomulusLoader vulkan-1.dll,campaign:TA4922
sha256,3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d,prevent,critical,2027-03-10,RomulusLoader vulkan-1.bin payload blob,campaign:TA4922
sha256,314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef,prevent,high,2027-03-10,RomulusLoader Alles in dem schuppen.zip,campaign:TA4922
sha256,2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d,prevent,critical,2027-03-10,RomulusLoader Alles in dem schuppen.exe,campaign:TA4922
sha256,0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8,prevent,critical,2027-03-10,RomulusLoader teamspeak_control.dll,campaign:TA4922
sha256,e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c,prevent,critical,2027-03-10,SilentRunLoader executable,campaign:TA4922
sha256,de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2,prevent,high,2027-03-10,SilentRunLoader ZIP,campaign:TA4922
sha256,9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73,prevent,critical,2027-03-10,SilentRunLoader executable,campaign:TA4922
ipv4,206.238.115.58,prevent,critical,2027-03-10,Atlas RAT C2 (port 886),campaign:TA4922
ipv4,154.211.86.110,prevent,critical,2027-03-10,Atlas RAT C2 (port 886),campaign:TA4922
ipv4,43.156.77.97,prevent,high,2027-03-10,RomulusLoader C2 (port 1234),campaign:TA4922
ipv4,103.214.172.33,prevent,high,2027-03-10,RomulusLoader C2 (RMM deployment campaign),campaign:TA4922
ipv4,18.139.83.110,detect,medium,2026-12-10,SilentRunLoader C2 - single-source (Proofpoint primary only),campaign:TA4922
domain,ws.ztts88.cyou,prevent,high,2027-03-10,SilentRunLoader C2/exfil,campaign:TA4922
domain,aeya388.club,detect,low,2026-12-10,ValleyRAT/Winos4.0 C2 - single-source (T2 press only) hunting lead,campaign:TA4922
domain,nwphotoblog.com,detect,medium,2026-12-10,RomulusLoader RMM-deployment landing page,campaign:TA4922

Sideload carrier pair: vulkaninfo.exe (legit-named) + vulkan-1.dll / vulkan-1.bin, outside Program Files
Sideload DLL names: libcef.dll, teamspeak_control.dll, outside their legitimate app's Program Files tree
Atlas RAT check-in string: "SFuck" + 3 null bytes
Atlas RAT core module export: AtlasInfo
Atlas RAT anti-sandbox checks: WDAGUtilityAccount, CExecSvc, mshome DNS suffix, vmsmb device, WDAG registry key
Atlas RAT C2 ports: TCP 886 (ChaCha-encrypted); RomulusLoader C2 port: TCP 1234 (RC4/XOR)
RomulusLoader persistence: copy to C:\Program Files\Common Files
RomulusLoader injection targets: svchost.exe, dllhost.exe
SilentRunLoader internal name: silent_run_and_upload.py; exfil endpoint pattern: /upload.php
SilentRunLoader placeholder artifact (LLM-generated code marker): "your_secret_key_here"
Delivery archetype: HR/payroll/tax-authority/VAT/invoice/compliance-themed lure -> ZIP/RAR/IMG on GoFile/LimeWire/MediaFire -> DLL sideload
Out-of-band pivot: lure text redirects victim from email to WhatsApp, LINE, or Microsoft Teams

Atlas RAT - custom multi-stage backdoor with core module + plugins (newly documented, June 2026)
RomulusLoader - C-language loader, PE loader + RC4/XOR, process hollowing, first seen 2026-03-23
SilentRunLoader - compiled Python loader/stealer, Chrome credential theft, first seen 2026-03-30
Winos4.0 / ValleyRAT - modular open-source-derived C2 framework, RC4-encrypted config, DDoS module
Legitimate tools abused for follow-on access: AnyDesk, SyncFuture (Chinese RMM software)
Actor aliases / overlap: TA4922 (Proofpoint); tooling/infra overlap noted with Silver Fox and Void Arachne clusters

[ ] WDAC/AppLocker policy blocking unsigned DLL loads from user-writable paths (Downloads/AppData/Temp) - deployed and enforced
[ ] ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" - enabled
[ ] ASR rule "Block Office communication application from creating child processes" - enabled (if relevant to your lure vector)
[ ] Egress firewall rule blocking outbound TCP 886 and 1234 to non-approved destinations - deployed
[ ] DNS sinkhole/block entries for ws.ztts88.cyou and aeya388.club - deployed
[ ] Exchange Online Safe Attachments/Safe Links tuned for payroll/tax/invoice keyword + archive attachment combination - verified
[ ] Chrome Enterprise policy: PasswordManagerEnabled=false or App-Bound Encryption enforced - verified
[ ] RMM application allowlist restricting AnyDesk/SyncFuture to IT-managed deployment only - verified

JSON (machine-readable)

{
  "pack": "TA4922-Atlas-RAT-Hunt",
  "version": "0.1",
  "date": "2026-09-10",
  "indicators": {
    "sha256": [
      "a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295",
      "584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8",
      "66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d",
      "4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d",
      "a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad",
      "40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5",
      "8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0",
      "3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d",
      "314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef",
      "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d",
      "0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8",
      "e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c",
      "de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2",
      "9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73"
    ],
    "c2_ipv4_port": ["206.238.115.58:886", "154.211.86.110:886", "43.156.77.97:1234"],
    "c2_ipv4": ["103.214.172.33", "18.139.83.110"],
    "c2_domain_high_conf": ["ws.ztts88.cyou"],
    "c2_domain_low_conf_single_source": ["aeya388.club"],
    "landing_page_domain": ["nwphotoblog.com"]
  }
}

Playbook A — Firewall block for confirmed C2 (Windows, PowerShell)

Prerequisites: Local admin or GPO deployment rights; PowerShell 5.1+; confirm 206.238.115.58,
  154.211.86.110, 43.156.77.97, 103.214.172.33 are not in use by any legitimate internal service
  before blocking (run Q2 in Investigate mode first).
Reboot required: No

New-NetFirewallRule -DisplayName "BLOCK-TA4922-C2-Outbound" -Direction Outbound `
  -RemoteAddress 206.238.115.58,154.211.86.110,43.156.77.97,103.214.172.33 `
  -Action Block -Profile Any -Enabled True

# Verify:
Get-NetFirewallRule -DisplayName "BLOCK-TA4922-C2-Outbound" | Get-NetFirewallAddressFilter

Rollback: Remove-NetFirewallRule -DisplayName "BLOCK-TA4922-C2-Outbound"

Playbook B — WDAC/AppLocker rule blocking DLL execution from user-writable paths (Windows, GPO/PowerShell)

Prerequisites: Windows 10/11 Enterprise or Server; AppLocker service running (sc config AppIDSvc
  start=auto); pilot ring identified before fleet-wide Enforce; back up existing AppLocker/WDAC
  policy XML before editing.
Reboot required: No (policy refresh via gpupdate /force is sufficient; a logoff/logon may be
  needed for interactive users to pick up new Enforce-mode blocks cleanly)

# Example AppLocker DLL rule (Audit mode first) via PowerShell:
$Rule = New-AppLockerPolicy -RuleType Path -User Everyone -RuleNamePrefix "TA4922-DLL-Block" `
  -PathCondition "%OSDRIVE%\Users\*\Downloads\*.dll","%OSDRIVE%\Users\*\AppData\*\*.dll","%OSDRIVE%\Users\*\AppData\Local\Temp\*.dll" `
  -Action Deny -XMLPolicy
Set-AppLockerPolicy -PolicyObject $Rule -Merge   # start in Audit; switch collection to Enforce
  # only after 7+ days of benign-baseline review (Section 11)

Rollback: Set-AppLockerPolicy -PolicyObject (Get-AppLockerPolicy -Local) -Merge  with the prior
  saved policy XML re-imported; or Clear-AppLockerPolicy for the affected rule collection.

Playbook C — DNS sinkhole entries for confirmed loader/stealer C2 (Windows DNS Server policy)

Prerequisites: Windows Server DNS role with DNS Policy support (Server 2016+), or equivalent
  sinkhole capability on your DNS/SWG platform; confirm ws.ztts88.cyou is not a legitimate
  business dependency (it is not, per source; flagged actor infrastructure only).
Reboot required: No

Add-DnsServerQueryResolutionPolicy -Name "TA4922-Sinkhole" -Action IGNORE `
  -FQDN "EQ,ws.ztts88.cyou,*.ws.ztts88.cyou"

# aeya388.club is single-source (Section 4) - deploy as MONITOR/ALERT only, not a hard sinkhole,
# until corroborated by a second source:
Add-DnsServerQueryResolutionPolicy -Name "TA4922-Monitor-LowConf" -Action IGNORE `
  -FQDN "EQ,aeya388.club,*.aeya388.club" -PassThru   # review hit volume before enforcing

Rollback: Remove-DnsServerQueryResolutionPolicy -Name "TA4922-Sinkhole"
          Remove-DnsServerQueryResolutionPolicy -Name "TA4922-Monitor-LowConf"

Playbook D — Exchange Online Safe Attachments tuning (M365, PowerShell / Exchange Online Management module)

Prerequisites: Exchange Online Management PowerShell module; Global Admin or Security Admin role;
  Microsoft Defender for Office 365 Plan 1/2 license (Safe Attachments requires it).
Reboot required: No

Connect-ExchangeOnline
New-SafeAttachmentRule -Name "TA4922-Payroll-Tax-Lure-Archives" -SafeAttachmentPolicy "Block" `
  -RecipientDomainIs "yourdomain.example.com" `
  -Comments "Flags external ZIP/RAR/IMG attachments on messages with payroll/tax/invoice/compliance
             subject-keyword matches, per TA4922/Atlas RAT hunt pack v0.1 2026-09-10"
  # Combine with a transport rule matching subject keywords (localize per target language) and
  # attachment extension .zip/.rar/.img from external senders.

Rollback: Remove-SafeAttachmentRule -Identity "TA4922-Payroll-Tax-Lure-Archives"

Playbook E — Chrome Enterprise credential-store hardening (GPO ADMX / registry)

Prerequisites: Chrome Enterprise ADMX templates installed in the GPO Central Store; test in a
  pilot OU first — disabling password saving is user-visible and will generate helpdesk tickets
  if not communicated.
Reboot required: No (policy applies on next Chrome restart / gpupdate)

# Registry path used by the Chrome ADMX policy (HKLM, machine-wide):
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f

# Verify:
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /v PasswordManagerEnabled

Rollback: reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v PasswordManagerEnabled /f
  (returns to Chrome default, which is enabled)

Validation gates (Section 11) are folded in here: telemetry-readiness and benign-baseline review must both be confirmed per-tenant before any "Good" or "Partial" row above is treated as production-ready in your environment.

All six source snapshots (verbatim fetched text) are saved under TA4922-Atlas-RAT-Hunt-sources/ alongside this file for provenance validation.