ProofpointPublished
Carry-On Compromise: TA4922 Packs PackClient
By Kyle Cucci, Rob Kinner, Tony Robinson and the Proofpoint Threat Research Team
Excerpt
August 27, 2026 Kyle Cucci, Rob Kinner, Tony Robinson and the Proofpoint Threat Research Team Key Findings
Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor, Chinese-speaking TA4922.
With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem.
Overview
Proofpoint researchers recently discovered a RAT framework we named PackClient…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Proofpoint on proofpoint.com.
Mentioned in the excerpt
More from Proofpoint7
- Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesProofpoint · Published 30 Sep
- Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click ExploitProofpoint · Published 28 Jul
- ta458 roundpress exploitsProofpoint · Published 15 Jul
- TA488 Targets Zimbra Mailservers with Half-Click ExploitsProofpoint · Published 15 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
