DNS Investigation: Threat Actor TA4922 Goes Global
Proofpoint uncovered1 the global expansion of TA4922, a suspected Chinese-speaking cybercrime group that rapidly rotates malware—including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0)—and used localized HR-, tax-, and invoice-themed lures to deliver malware, credential phishing, and fraud schemes across Asia, Europe, and Africa.
The original analysis publicized seven network IoCs. Aided by the WhoisXML API MCP Server2, we investigated eight IoCs—one subdomain, two domains, and five IP addresses—after extracting the apex domain from the subdomain IoC.
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Domain IoC WHOIS and DNS history analysis
- Client and potential victim traffic analysis
- IP IoC geolocation and resolution history analysis
- Email-connected domain discovery
- IP-connected domain and malicious artifact discovery
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
DNS Spotlight: BigBear 2.0 PhaaS Targets Span 40+ Countries
WhoisXML API uncovered 1,600+ additional artifacts linked to BigBear 2.0. Download the threat research materials now.
A DNS Investigation of the ASCII Smuggling Phishing Campaign
WhoisXML API uncovered 100+ additional artifacts linked to the ASCII smuggling phishing campaign. Download the threat research materials now.
A DNS Deep Dive into a Silver Fox-Style Fake Installer Campaign
WhoisXML API uncovered 1,500+ additional artifacts linked to a Silver Fox-style fake installer campaign. Download the threat research materials now.