Proofpoint Warns TA4922 Deploys Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT

A sophisticated cybercrime group known as TA4922 is raising alarms across the global security community.

The group has been deploying a growing arsenal of malware, including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT, against organizations in Japan, the United Kingdom, Germany, and across Southeast Asia.

These campaigns are financially motivated and show a level of planning that sets TA4922 apart from typical criminal groups. The group’s reach is no longer regional. It is becoming a global threat.

What makes TA4922 especially dangerous is how it tricks its victims. The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams.

These messages are written in the target’s local language and look convincing enough to fool cautious employees. Once a victim clicks a link or opens an attachment, the malware silently installs itself.

Analysts at Proofpoint identified and documented this activity in a detailed threat report shared with Cyber Security News (CSN). According to Proofpoint, TA4922 is a highly sophisticated actor with a rapidly evolving malware arsenal.

The group is assessed to be financially motivated, with goals including data theft, fraud, and persistent access to victim environments. Proofpoint notes that TA4922 currently conducts more unique campaigns than any other tracked cybercrime actor in their threat data.

The group first appeared on Proofpoint’s radar in spring 2025, initially focused on East Asia. By early 2026, TA4922 had dramatically expanded into Europe and South Africa.

The group mixes malicious activity with legitimate tools and trusted cloud hosting services, making their attacks harder to detect.

One of the more alarming aspects of TA4922’s behavior is how fast it builds new tools. Proofpoint assessed with high confidence that the group likely uses AI coding tools to rapidly develop new Python-based malware.

Unchanged placeholder values in SilentRunLoader’s code, such as the string “your_secret_key_here,” suggest code was generated with minimal review. This fast development cycle means defenders are constantly chasing new variants.

TA4922 Deploys Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT

TA4922 ran several notable campaigns between March and April 2026, each deploying different malware. In early March, the group sent HR-themed emails to organizations in Japan disguised as salary adjustment notices.

These carried ZIP files hosted on GoFile, and once opened, triggered DLL sideloading to deliver Atlas RAT, which connected to a command-and-control server at 206.238.115.58 over port 886.

A second Atlas RAT campaign in April targeted organizations in the UK and Germany using HR lures with filenames like “Paperwork.zip.” RomulusLoader appeared in late March, targeting Japanese organizations via LimeWire-hosted files.

In mid-April, TA4922 used RomulusLoader to push legitimate remote monitoring tools such as AnyDesk and SyncFuture, blending into normal network traffic.

SilentRunLoader was deployed against UK targets using fake tax authority emails, stealing Chrome credentials and sending them to an actor-controlled server.

Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.

It runs multiple anti-sandbox checks and communicates with its server using ChaCha encryption. ValleyRAT, built on the Winos4.0 framework, adds DDoS support and downloads additional modules on demand. Together, these tools give TA4922 deep and persistent access to compromised systems.

Defending Against TA4922 and Its Malware Tools

Organizations need to act now to reduce their exposure to this threat. Proofpoint recommends enforcing application allowlisting on trusted directories to prevent unapproved executables from running.

Teams should also monitor or prevent execution from temporary folders like %TEMP% and %APPDATA%, commonly abused by malware like RomulusLoader. Watching for executables written to root directories can help catch suspicious activity early.

Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure. Applying least-privilege principles across accounts limits how much damage an attacker can cause once inside a network.

Since TA4922 is known to move victims from email to messaging platforms like WhatsApp and Microsoft Teams, security teams should train employees to recognize and report this social engineering before it leads to a full compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.