Proofpoint Warns of TA4922 Cybercrime Group Deploying Multiple Malware Strains Across Global Targets
By
Tushar Subhra Dutta
Crackling crust, pillowy middle. The kind of bagel that earns a second cup of coffee.
Summary
Proofpoint has identified a financially motivated cybercrime group, TA4922, that is deploying multiple malware strains—including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT—against organizations in Japan, the UK, Germany, and Southeast Asia. The group's sophisticated social engineering tactics and expanding global reach make it a significant and growing threat to the security community.
Key quotes
· 4 pulledA sophisticated cybercrime group known as TA4922 is raising alarms across the global security community.
These campaigns are financially motivated and show a level of planning that sets TA4922 apart from typical criminal groups.
The group's reach is no longer regional. It is becoming a global threat.
What makes TA4922 especially dangerous is how it tricks its victims.
You might also wanna read
Investigating the Identity Behind the Ransomware Group 'The Gentlemen'
A cybercrime group called The Gentlemen has become the second most active ransomware gang by victim count, using an aggressive recruitment s
Checkout.com Responds to Cyber Extortion Attempt Targeting Legacy System
Checkout.com experienced a cyber extortion attempt by the criminal group 'ShinyHunters' who gained unauthorized access to a legacy third-par
checkout.com·7mo ago
Bitwarden CLI 2026.4.0 Compromised in Checkmarx Supply Chain Attack via GitHub Action
Socket researchers discovered that Bitwarden CLI version 2026.4.0 was compromised as part of the ongoing Checkmarx supply chain campaign. Th
socket.dev·1mo ago
Glassworm Threat Actor Returns with Unicode-Based Supply Chain Attacks on GitHub, npm, and VS Code
The Glassworm threat actor has returned with a new wave of supply chain attacks using invisible Unicode characters to compromise software re
aikido.dev·3mo ago
Russian Cybercrime Groups Exploit WinRAR Zero-Day Vulnerability
A high-severity zero-day vulnerability in WinRAR is being actively exploited by two Russian cybercrime groups, allowing them to backdoor com
arstechnica.com·10mo ago
Technical Analysis of CVE-2025-10035: A CVSS 10.0 Vulnerability in Fortra GoAnywhere MFT
watchTowr Labs analyzes CVE-2025-10035, a critical CVSS 10.0 vulnerability in Fortra's GoAnywhere MFT (managed file transfer) solution. The
labs.watchtowr.com·8mo ago