{"id":263960,"date":"2026-06-04T08:22:00","date_gmt":"2026-06-04T12:22:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/04\/china-linked-ta4922-expands-phishing-attacks-to-uk-germany-italy-and-south-africa\/"},"modified":"2026-06-04T09:50:09","modified_gmt":"2026-06-04T13:50:09","slug":"china-linked-ta4922-expands-phishing-attacks-to-uk-germany-italy-and-south-africa","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/04\/china-linked-ta4922-expands-phishing-attacks-to-uk-germany-italy-and-south-africa\/","title":{"rendered":"China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa"},"content":{"rendered":"

China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/06\/china-linked-ta4922-expands-phishing.html<\/a><\/p>\n

Publish Date: 2026-06-04 08:22:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Jun 04, 2026<\/span><\/span>Malware \/ Cybercrime<\/span><\/p>\n

A new China-linked cybercrime group known as TA4922 has expanded its targeting focus to target European organizations in the U.K., Germany, Italy, and South Africa.<\/p>\n

These efforts have been complemented by a “rapid operational tempo” and a continually evolving malware arsenal comprising known families like ValleyRAT (aka Winos 4.0) and Atlas RAT (aka AtlasCross RAT), as well as previously undocumented tools called RomulusLoader and SilentRunLoader, according to Proofpoint.<\/p>\n

The enterprise security company is keeping tabs on the activity under the moniker TA4922, describing it as a Chinese-speaking threat actor largely targeting East Asia. TA4922 is assessed to share some level of overlap with Silver Fox, with the threat actor’s tradecraft more focused on cybercriminal objectives than espionage.<\/p>\n

“The actor is likely financially motivated and focused on obtaining remote access to victim environments for financial gain, such as data theft, fraud, access resale, or persistent access,” the company said, characterizing it as an adversary conducting “more unique campaigns” than any other threat actor it tracks.<\/p>\n

In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader.<\/p>\n

Another notable shift involves attempts to move conversations from emails to out-of-band communication channels like LINE, WhatsApp, and Microsoft Teams, allowing the attackers to bypass enterprise security controls and steal data or deliver malware. Details of some of the recently observed TA4922 phishing campaigns are below –<\/p>\n