Threat Actor 🇨🇳 China

TA4922

TA4922 is a Chinese-speaking cybercrime cluster that employs localized HR, payroll, tax, and invoice lures to deliver various malware families, including Atlas RAT, RomulusLoader, and SilentRunLoader. The actor conducts targeted email campaigns, often impersonating trusted authorities, to facilitate credential phishing and fraud. TA4922's operational tempo is high, with a focus on obtaining remote access for financial gain, and it has shown a rapid evolution in its malware arsenal. The group is also noted for using social engineering to shift communications from email to messaging platforms, enhancing their phishing efforts.

Indicators of Compromise 2

Filename GoFlyDrv.sys Filename putty

MITRE ATT&CK TTPs 12

T1006
Direct Volume Access
Defense Evasion
 T1012
Query Registry
Discovery
 T1014
Rootkit
Defense Evasion
 T1053.005
Scheduled Task
Execution
 T1055
Process Injection
Defense Evasion
 T1055.015
ListPlanting
Defense Evasion
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1204.002
Malicious File
Execution
 T1548.002
Bypass User Account Control
Privilege Escalation

Source Articles

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
Cruciferra, a sophisticated crypter service linked to a China-based cybercrime group, is being used to deliver remote access trojans (RATs) and information stealers via phishing campaigns. It leverages advanced evasion techniques such as BYOVD, Process Ghosting, and API unhooking to avoid detection and hinder analysis. The threat targets multiple sectors including finance, healthcare, and government, primarily through tax-themed and social engineering lures. The malware establishes persistence via registry modifications and executes payloads in memory to minimize forensic traces.
hacker-news ·1d ago