Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
financialThreat Actor
Active Threat
TA4922
41
IOCs Tracked
6
Intel Reports
Associated IOCs41 total
IP7
89.34.90.99
2026-10-09High192.252.180.45
2026-10-09High64.81.30.992026-10-09High206.238.196.96
2026-10-09High192.229.87.2192026-10-09High154.36.188.982026-08-29High154.36.188.2012026-10-09MediumDomain4
0zbqnac1t4dv2t2wuodv1m.com2026-10-09High
gatuso.duckdns.org2026-10-09High
gov12366.com2026-10-09Medium
exploit.in
2026-10-09LowURL3
http://154.36.188.98:8080/Sz9110.bin2026-10-09High
https://digital-magicians.com/photo295825092412.zip?_r=ea6232022026-10-09High
https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar2026-10-09High
SHA25626
a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f92952026-06-06High
584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae82026-06-06High
7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a2026-10-09High
3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d2026-10-09High
5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df2026-10-09High
fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da532026-10-09Medium
109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b72026-10-09Medium
a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e022026-10-09Medium
35712dc8aa497371ce48a36975781dfc3a120ce5c99dc209637b05751bf4e8e92026-10-09Medium
38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c2026-10-09Medium
83d16cd963b1926a9967e6928340f099abf983ca496639cfddd9d63e327db3d22026-10-09Medium
c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e2998092026-10-09Medium
da90b1219dcf1bf23e604b182b7737e188825df7205ea7b172231de66aeba2932026-10-09Medium
59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d33472026-10-09Medium
2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a2026-10-09Medium
aa8cda8a9a7835a72d1b832985c5976873d2c6e791524039b809ce4441d3f69f2026-10-09Medium
17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc42026-10-09Medium
c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f02026-10-09Medium
09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde12026-10-09Medium
832e68e12ebf62b60cfe2a7b45e5948fcc364a74c8d73c3748b267617bcfb2422026-10-09Medium
66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb8652026-10-09Medium
7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff942026-10-09Medium
c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c2026-10-09Medium
7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee82026-10-09Medium
6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac2026-10-09Medium
3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e2026-10-09Medium
CVE1
CVE-2026-02572026-07-21High
Related Reports6 total
Carry-On Compromise: TA4922 Packs PackClient
Proofpoint Threat InsightAug 27, 2026
Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service
Proofpoint Threat InsightJul 20, 2026
TA4922 Hackers Use Tax Phishing to Deploy PackClient RAT Across Asia
Cyber PressAug 29, 2026
The Good, the Bad and the Ugly in Cybersecurity – Week 23
SentinelOne BlogJun 5, 2026
Proofpoint Warns TA4922 Deploys Atlas RAT and Multiple Malware Loaders
Cyber PressJun 4, 2026
Threat Profile
Motivationfinancial
Last seenOct 2026
IOCs tracked41