ET-3461
📛 Threat Title
SIGS: PackClient stream-aware signatures and Core startup correlation
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- SIGS: PackClient stream-aware signatures and Core startup correlation Emerging Threats Community
Remediations (10)
-
web:blog.deception.pro
How This Fits the PackClient Campaign Per Proofpoint's research, PackClient is a full-featured, modular C2 framework advertised on Chinese-language Telegram channels and used by at least one Chinese-speaking threat actor, TA4922.
-
web:bulwarkblack.com
That matters because many organizations still treat phishing defense as a user-awareness problem. Awareness helps, but PackClient -style intrusions need layered controls that catch the execution chain after the click: archive handling, mounted disk-image execution, DLL sideloading, suspicious rundll32 usage, registry autoruns, unusual raw TCP connections, and unexpected remote management tooling.
-
web:cyfar.ca
Carry-On Compromise: TA4922 Packs PackClient Proofpoint identified PackClient , a modular RAT and C2 framework marketed on Telegram and used by TA4922 in tax-themed phishing campaigns targeting organizations in China and India between May and July 2026.
-
web:gbhackers.com
A Chinese-speaking threat actor tracked as TA4922 is deploying the PackClient remote access trojan via tax-themed phishing campaigns targeting organizations in mainland China and India.
-
web:news.loaris.com
Learn how PackClient malware arrives in tax-themed lures, what its remote-access features can expose, and how to contain, scan, and recover safely.
-
web:securityonline.info
Proofpoint found the PackClient RAT sold on Telegram and used by Chinese-speaking TA4922 malware operators in tax-themed phishing attacks.
-
web:sherer.io
TA4922 PackClient RAT Campaign Threat Hunt Threat Overview Proofpoint published new research on August 27, 2026 describing PackClient , a modular remote-access and command- and -control framework actively used by the Chinese-speaking threat actor TA4922 and apparently marketed to other actors through Telegram.
-
web:socprime.com
Analysis revealed a multi-stage execution flow involving a downloader, a launcher component, and the final PackClient core RAT module. Mitigation Organizations should monitor for suspicious rundll32.exe command lines and unusual persistence through the RunOnce registry key.
-
web:www.pcrisk.com
Conclusion PackClient RAT gives attackers complete remote control over infected devices, allowing them to spy on users, steal sensitive data, deploy additional malware, and carry out further attacks. Its multi-stage architecture, guard process, and system-file masquerading make it difficult to detect and remove manually.
-
web:www.proofpoint.com
Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor, Chinese-speaking TA4922. With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem. Overview Proofpoint researchers recently discovered a RAT ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.