Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
TA4922 Hackers Use Tax Phishing to Deploy PackClient RAT Across Asia
Threat Actors
Excerpt
A Chinese-speaking threat actor tracked as TA4922 is using tax-themed phishing campaigns to deploy PackClient, a modular remote access trojan (RAT) framework marketed through Telegram channels. Proofpoint researchers observed the group targeting organizations in mainland China and India during May and July 2026, using impersonated tax-authority notices to pressure recipients into opening malicious archives. The activity signals an expansion of TA4922’s initial-access toolkit…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 64.81.30.99 | High | Score 62/100 | First seen |
| IP | 206.238.196.96 | High | Score 61/100 | First seen |
| IP | 192.252.180.45 | High | Score 86/100 | First seen |
| SHA256 | 109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b7 | Medium | Score 55/100 | First seen |
| IP | 154.36.188.98 | High | Score 58/100 | First seen |
| Domain | gov12366.com | Medium | Score 57/100 | First seen |
| SHA256 | fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53 | Medium | Score 55/100 | First seen |
IOC Relationship Graph
Building graph…