TA4922 Launches PackClient Campaigns in Asia: Modular RAT Bought on Telegram

Chinese threat group TA4922 conducted tax-themed phishing campaigns in China and India between May and July 2026, distributing the PackClient RAT framework purchased as a commercial kit on Chinese-language Telegram marketplaces. The operation marks a turning point in the threat marketplace: modular frameworks with over 60 commands and dual C2, once the preserve of advanced actors, are now standardized commodities accessible to groups that do not develop proprietary tools.

Two Waves, Same Payload: The China-India Chain

The May campaign in China impersonated the Shandong Provincial Tax Bureau. The initial vector was a ZIP archive named 数据资料.zip hosted on gov12366[.]com, containing the executable 资料数据.exe. The infection chain, as documented by the source, proceeds with an administrative privilege check, drops a DLL (xMain.dll), and executes via rundll32.exe. The system then retrieves an encrypted payload, writes %TEMP%\svchost.exe, and establishes persistence through a registry RunOnce key.

In July, the Indian campaign replicated the structure with Hindi localization and Indian Income Tax Department lures. Here the vector uses ZIP archives containing mountable IMG files: inside, a legitimate executable paired with a malicious DLL triggers DLL sideloading, which loads the Donut Loader responsible for the final PackClient installation. The technical convergence between the two waves — same RAT framework, same modular architecture — confirms that TA4922 operates with a standardized toolkit, not custom code adapted for each target.

PackClient: Anatomy of a RAT-as-a-Kit

The structural novelty lies in the procurement model. According to the source, PackClient is "malware bought through Chinese-language marketplaces on Telegram rather than building every tool in house." The framework comprises a downloader, loader, core RAT, and plugin library with over 60 supported commands across two simultaneous C2 channels. The in-memory launcher (PackClientLauncher) loads PackClientCore without evident files, reducing the signature-based detection surface.

Persistence mechanisms are multiple: beyond the registry RunOnce key, a watchdog process (svchost.exe --guard) monitors installation integrity. Communication with command servers occurs over TCP, with documented addresses at 64.81.30[.]99, 192.252.180[.]45:6666, 154.36.188[.]98:8080 (launcher download) and 206.238.196[.]96:6666 (C2 TCP). The malware configuration is stored in HKCU\SOFTWARE\PackClientConsole.

The framework also integrates a specific check for the presence of Telegram Desktop; an associated plugin is potentially capable of modifying local application configurations. The source does not specify whether this capability has been actively used in confirmed cases.

"The RAT can run more than 60 commands over two simultaneous command and control channels, according to Proofpoint's analysis, which is an unusually high number for a tool still being sold through underground channels rather than developed for a single client"

ManageEngine RMM: The Jump to Persistent Interactive Access

In at least one confirmed case documented by the source, operators installed ManageEngine remote monitoring and management software "several hours after the initial infection." The move signals a deliberate shift from the RAT's stealthy access to a more durable interactive presence, leveraging legitimate tools to blend into standard enterprise traffic. The use of commercial RMM as an additional persistence layer further erodes the boundary between malicious activity and legitimate IT operations.

What to Do Now

The dossier does not document specific vendor remediation measures or explicit operational recommendations from the primary source. The actions below derive exclusively from the confirmed technical mechanisms in the analysis:

• Monitor rundll32.exe executions loading DLLs from temporary directories, the central pattern in the Chinese infection chain.
• Inspect registry RunOnce keys pointing to %TEMP%\svchost.exe, a documented persistence indicator.
• Check for svchost.exe processes with the --guard argument, a signal of the PackClient watchdog.
• Examine outbound TCP traffic to port 6666, used by the documented C2 servers in both campaigns.

Why It Matters

The malware market is undergoing a standardization phase that redraws the threat hierarchy. When a framework with 60+ commands and dual C2 is available on Telegram, the competitive advantage of APTs that invested months in custom development dissolves. TA4922 itself, active since 2025 and previously associated with proprietary payloads like Atlas RAT and RomulusLoader, opted for commercial purchase: this suggests the economic calculus favors the kit over internal R&D.

The consequence for defense is an attribution and monitoring problem. Multiple groups buying the same frameworks generate technical overlaps that make it harder to link an intrusion to a specific actor. At the same time, the democratization of sophisticated tools expands the pool of operators capable of campaigns with multi-layered persistence, living-off-the-land, and RMM. Signature-based detection of malicious code becomes insufficient when the code is legitimate, the loader is in-memory, and C2 channels use standard ports.

The source does not specify whether other groups beyond TA4922 are already operating with PackClient, nor whether the documented C2 servers remain active. These gaps leave two open questions: the true scale of the framework's proliferation, and the speed at which the RAT-as-a-kit model will be replicated for other messaging platforms and language markets.

Sources

• https://www.kobaran.com/tax-season-phishing-scheme-spreads-new-packclient-malware-across-asia/
• https://www.brinztech.com/breach-alerts/brinztech-alert-ta4922-deploys-new-packclient-rat-framework-in-global-tax-themed-phishing-campaigns
• https://nvd.nist.gov/vuln/detail/CVE-2026-69414
• https://nvd.nist.gov/vuln
• https://nvd.nist.gov/vuln/detail/CVE-2026-20182
• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?cveId=CVE-2026-20182&vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H&version=3.1&sourceName=Cisco%20Systems,%20Inc
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk