Chinese Threat Actor TA4922 Deploys PackClient RAT in Tax-Themed Phishing Campaigns
A Chinese-speaking threat group tracked as TA4922 has been deploying the PackClient remote access trojan (RAT) in targeted phishing campaigns against organizations in mainland China and India. The activity, observed by Proofpoint in May and July 2026, highlights the group’s expanding initial-access tactics and the growing availability of sophisticated malware on Chinese-language Telegram marketplaces.
Attack Overview
PackClient is a modular RAT framework capable of supporting espionage, financial fraud, reconnaissance, credential theft, data exfiltration, and ransomware operations. The malware is sold via Telegram channels and consists of:
- An initial downloader
- A second-stage loader (PackClientLauncher)
- The PackClientCore RAT module
- Downloadable plugins for extended functionality
Campaign Details
China-Targeted Attacks (Late May 2026)
TA4922 impersonated the Shandong Provincial Tax Bureau, sending emails claiming recipients had been selected for a 2026 tax inspection and owed unpaid stamp duties. Victims were directed to download a ZIP archive (数据资料.zip) from gov12366[.]com, a domain mimicking a government tax service.
The archive contained 资料数据.exe, which initiated the infection chain:
- The downloader checked for elevated permissions, dropped a DLL (e.g., xMain.dll), and executed it via rundll32.exe.
- It retrieved an encrypted payload, decrypted it, and saved it as %TEMP%\svchost.exe.
- The malware established persistence via a RunOnce registry entry to survive reboots.
India-Targeted Attacks (Mid-July 2026)
TA4922 shifted focus to Indian targets, sending Hindi-language emails impersonating the Indian Income Tax Department. The messages accused recipients of underreporting income or failing to disclose foreign assets, threatening penalties.
Victims were tricked into opening ZIP archives (e.g., Tax_Notice_23665.zip, ITDTAX202601987.zip), which contained IMG disk-image files. Upon mounting, these files executed DLL sideloading to deploy Donut Loader, ultimately installing PackClient.
Post-Compromise Activity
- Command-and-Control (C2) Traffic: Observed connections to 64[.]81[.]30[.]99 and 192[.]252[.]180[.]45:6666.
- Lateral Movement: Attackers installed ManageEngine Remote Monitoring and Management software hours after initial infection, likely to expand remote access.
- PackClientCore Capabilities: The RAT supports 60+ commands, including:
- Shell command execution
- File management & process enumeration
- Screenshot & webcam capture
- Keylogging & browser data theft
- Registry modification & proxy tunneling
- Clipboard manipulation & plugin downloads
- Telegram Monitoring: The malware checks for Telegram Desktop, suggesting potential plugin-based surveillance of local Telegram communications.
- Configuration Storage: PackClient stores settings in HKCU\SOFTWARE\PackClientConsole</strong>, including C2 servers, ports, campaign IDs, and system UUIDs.
Detection & Indicators of Compromise (IOCs)
Defenders should monitor for:
- rundll32.exe loading DLLs from temporary directories
- RunOnce registry entries launching %TEMP%\svchost.exe
- Processes using the svchost.exe --guard argument (restarts the RAT if terminated)
- Unexpected outbound TCP traffic on port 6666
- Tax-themed ZIP/IMG attachments
- Unapproved remote-management software deployments
Key IOCs:
- IPs: 154.36.188[.]98:8080, 206.238.196[.]96:6666, 64[.]81[.]30[.]99, 192[.]252[.]180[.]45:6666
- Domain: gov12366[.]com
- SHA-256 Hashes:
- 109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b7 (数据资料.zip)
- fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53 (资料数据.exe)
Source: https://gbhackers.com/chinese-hackers-deploy-packclient-rat/
IFTAS - Indian Financial Technology & Allied Services cybersecurity rating report: https://www.rankiteo.com/company/indian-financial-technology-&-allied-services
Proofpoint cybersecurity rating report: https://www.rankiteo.com/company/proofpoint
"id": "INDPRO1787991896",
"linkid": "indian-financial-technology-&-allied-services, proofpoint",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': ['Government',
'Taxation',
'Financial Services'],
'location': ['Mainland China', 'India'],
'type': 'Organizations'}],
'attack_vector': 'Email Phishing, Malicious ZIP/IMG Attachments, DLL '
'Sideloading, Social Engineering',
'data_breach': {'data_encryption': 'Yes (payload encryption)',
'data_exfiltration': 'Yes',
'file_types_exposed': ['DLL', 'EXE', 'ZIP', 'IMG'],
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Browser Data',
'System Credentials',
'Screenshots',
'Webcam Data',
'Keylogging Data']},
'date_detected': '2026-05',
'date_publicly_disclosed': '2026-07',
'description': 'A Chinese-speaking threat group tracked as TA4922 has been '
'deploying the PackClient remote access trojan (RAT) in '
'targeted phishing campaigns against organizations in mainland '
'China and India. The activity highlights the group’s '
'expanding initial-access tactics and the growing availability '
'of sophisticated malware on Chinese-language Telegram '
'marketplaces.',
'impact': {'data_compromised': ['Shell command execution data',
'File management data',
'Screenshots',
'Webcam captures',
'Keylogging data',
'Browser data',
'Registry modifications',
'Clipboard data'],
'identity_theft_risk': 'High (PII exposure via keylogging, browser '
'data theft)',
'operational_impact': 'Potential unauthorized remote access, '
'lateral movement, and data exfiltration',
'payment_information_risk': 'High (potential financial fraud)',
'systems_affected': ['Windows systems with rundll32.exe and '
'svchost.exe processes']},
'initial_access_broker': {'backdoors_established': 'PackClient RAT '
'persistence via RunOnce '
'registry',
'entry_point': 'Phishing emails with malicious '
'attachments'},
'investigation_status': 'Ongoing',
'motivation': ['Espionage', 'Financial Fraud', 'Data Theft'],
'post_incident_analysis': {'corrective_actions': 'Implement advanced email '
'filtering, enhance endpoint '
'detection for DLL '
'sideloading, and monitor '
'for unusual registry '
'modifications and outbound '
'traffic',
'root_causes': 'Lack of email filtering for '
'tax-themed phishing, insufficient '
'monitoring of DLL sideloading and '
'unusual process execution'},
'ransomware': {'data_encryption': 'Yes (payload encryption)',
'data_exfiltration': 'Yes'},
'recommendations': ['Monitor for rundll32.exe loading DLLs from temporary '
'directories',
'Check for RunOnce registry entries launching '
'%TEMP%\\svchost.exe',
'Detect processes using the svchost.exe --guard argument',
'Block outbound TCP traffic on port 6666',
'Scan for tax-themed ZIP/IMG attachments',
'Audit for unapproved remote-management software '
'deployments'],
'references': [{'date_accessed': '2026-07', 'source': 'Proofpoint'}],
'response': {'enhanced_monitoring': 'Monitoring for rundll32.exe loading DLLs '
'from temporary directories, RunOnce '
'registry entries, and outbound TCP '
'traffic on port 6666',
'third_party_assistance': 'Proofpoint (threat intelligence)'},
'threat_actor': 'TA4922',
'title': 'Chinese Threat Actor TA4922 Deploys PackClient RAT in Tax-Themed '
'Phishing Campaigns',
'type': 'Phishing, Malware Deployment, Espionage, Financial Fraud, Credential '
'Theft, Data Exfiltration'}