Adversary Intelligence — 2026-06-04

Chinese Hackers Deploy New Atlas RAT Malware Targeting European Networks in Espionage Campaign

BLUFFormal attribution of TA4922's European campaigns to Chinese state direction remains very unlikely within six months, but the group's access-resale model and surveillance-grade tooling place it squarely at the crime-espionage nexus.

Proofpoint reported on June 3 that TA4922, a suspected Chinese-speaking cybercrime group, sharply escalated operations in March and April 2026, extending campaigns to the UK, Germany, Italy, and South Africa with three previously undocumented malware families 123. Atlas RAT, deployed via DLL sideloading in localized HR- and invoice-themed phishing campaigns, supports keylogging, file theft, screenshot capture, and webcam and audio recording 123. RomulusLoader stages legitimate RMM tools including AnyDesk and SyncFuture for persistent access, while SilentRunLoader, a Python-based payload, harvests Chrome credentials, cookies, and browsing data for exfiltration to attacker-controlled infrastructure 124. Proofpoint assessed that AI tools likely assisted in developing the Python-based payloads, citing placeholder strings and unchanged template values in the code 134.

Analysis
Formal EU or UK attribution of TA4922 to Chinese state direction is very unlikely within six months. No affected government has signaled investigative intent, and Proofpoint, the sole primary source, classifies TA4922 as a cybercrime cluster distinct from state-directed actors. Atlas RAT's audio, webcam, and keylogging capabilities exceed fraud tooling norms, and TA4922's access-resale posture places it at the organized crime-intelligence boundary. RomulusLoader's delivery of SyncFuture, a Chinese-market tool, against German targets indicates deliberate European targeting. TA4922's acceleration may instead reflect an access broker responding to buyer demand, with surveillance capabilities incidental to toolset origins. Moderate confidence reflects single-vendor sourcing without independent corroboration. European CERTs treating the group as cybercrime would need to shift to state-actor countermeasures if that framing changes.

4 sources

TA4922: The Suspected Chinese Crime Group is Going Global - Proofpoint
Chinese hackers use new Atlas RAT malware in European cyberattacks - BleepingComputer
China-linked TA4922 expands attacks to Europe & Africa - IT Brief Asia
China-Linked TA4922 Hackers Target UK, Europe With New SilentRunLoader Malware - HackRead