Chinese cybercrime group TA4922 expands global operations

Proofpoint reports that TA4922, a suspected Chinese-speaking cybercrime group previously focused on East Asian targets, has significantly expanded its operations worldwide. The group uses sophisticated social engineering campaigns, often impersonating government agencies or trusted organisations, to establish contact with victims before delivering malware from the Winos4.0 (ValleyRAT) ecosystem. Researchers observed the actor targeting organisations across multiple regions and industries, indicating a shift from regional towards broader global operations.

What this means for your organisation

When an actor moves from a regional to a global target set, the risk assessment changes for organisations that previously considered themselves out of reach. Impersonating government agencies is particularly effective because messages from authorities are rarely met with scepticism, and because they tend to land with finance, HR or the leadership team. Defence therefore depends as much on verification routines as on technology.

Berigo recommends

• Introduce a fixed routine for confirming approaches claiming to come from authorities, using a known contact point rather than the details in the message.
• Train the roles most often contacted from outside, particularly finance, HR and the leadership team.
• Block execution of attachments and installers received from external senders on standard workstations.
• Include this type of actor in the threat assessment presented to the board.

Source

• proofpoint.com