IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE7 IOCs

TA4922 Hackers Use Tax Phishing to Deploy PackClient RAT Across Asia

CP
Cyber Press
Published August 29, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYTA4922INFRASTRUCTURE64.81.30.99206.238.196.96192.252.180.45CAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure(5)
Capability
Victim

Indicators of Compromise

Indicators of Compromise7

TypeIndicatorConfidenceScoreFirst Seen
IP64.81.30.99
indicatorintel-blogloader
High
62
Aug 29, 26
IP206.238.196.96
c2intel-blogmalware
High
61
Aug 29, 26
IP192.252.180.45
botnetcryptominerintel-blog
High
86
Jul 18, 26
SHA256109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b7
file-hashintel-blogphishing
Medium
55
Aug 29, 26
IP154.36.188.98
indicatorintel-blognetwork
High
58
Aug 29, 26
Domaingov12366.com
indicatorintel-blogloader
Medium
57
Jul 22, 26
SHA256fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53
file-hashintel-blogphishing
Medium
55
Aug 29, 26

IOC Relationship Graph

IOC Relationship Graph7 total IOCs
IPSHA256Domain
IP4SHA2562Domain1Actors1REPORTTA4922 Hackers Use Tax PhiTA4922
scroll to zoom · drag to pan · click IOC to open