13 minhigh
Carry-On Compromise: TA4922 Packs PackClient
Proofpoint identified PackClient, a modular RAT and C2 framework marketed on Telegram and used by TA4922 in tax-themed phishing campaigns targeting organizations in China and India between May and July 2026. The malware employs a multi-stage loading chain with reflective DLL loading, registry-based persistence, and a custom TCP C2 protocol on port 6666. PackClient supports over 60 commands and a plugin system enabling keylogging, screen capture, proxy tunneling, webcam access, and potential Telegram traffic interception.
Sens:■ ImmediateConf:high
Showing defanged values
- domainbackdoor[.]cyouC2 domain embedded in PackClient core module DLL between PACKLKH2 anchor string; observed in malware configuration strings
- domaingov12366[.]comAttacker-controlled domain used to host initial ZIP archive payload (数据资料.zip) in the May 2026 China campaign
- domainxzz[.]camSecondary C2 domain embedded in PackClient core module DLL between PACKLKH1 and PACKLKH2 anchor strings; configured as S2 endpoint on port 443
- filename%TEMP%\svchost.exeDecrypted PackClientLauncher module written to disk by Stage 1 loader; masquerades as legitimate Windows svchost.exe
- filename%TEMP%\xMain.dllDLL dropped by Stage 1 initial executable and executed via rundll32.exe with exported function XMain
- ip154[.]36[.]188[.]201Post-infection traffic destination observed in India campaign (15 July 2026)
- ip154[.]36[.]188[.]98Stage 2 payload download server running Rejetto HFS 2.4.0 RC8 on port 8080; hosts encrypted .bin payloads for PackClientLauncher module retrieval
- ip192[.]229[.]87[.]219ManageEngine RMM server deployed by TA4922 several hours after initial PackClient infection (20 July 2026)
- ip192[.]252[.]180[.]45PackClient C2 infrastructure over TCP port 6666 observed in second India campaign (20-22 July 2026)
- ip206[.]238[.]196[.]96Primary C2 server for PackClient over raw TCP port 6666 using custom protocol with byte sequence headers
- ip64[.]81[.]30[.]99PackClient C2 infrastructure observed in India campaign targeting organizations with Hindi-language tax lures (mid-July 2026)
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\RuntimeBrokerRegistry persistence key set by Stage 1 loader to execute %TEMP%\svchost.exe on next login
- registry_keyHKCU\SOFTWARE\PackClientConsoleRegistry location where PackClient core module stores C2 configuration including host, port, group, remark, device UUID, and installation timestamp
- sha256109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b7SHA256 hash of 数据资料.zip archive delivering PackClient in the May 2026 China campaign
- sha25635712dc8aa497371ce48a36975781dfc3a120ce5c99dc209637b05751bf4e8e9Tax_Notice_00481.img IMG disk image from third India campaign (22 July 2026)
- sha25638ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04cTax_Notice_23665.img IMG disk image from India campaign containing DLL sideloading payload (15 July 2026)
- sha2567108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85aTax_Notice_23665.zip ZIP attachment from India campaign (15 July 2026)
- sha2567295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94nvdahelperremote.dll malicious DLL used for DLL sideloading in India campaign (15 July 2026)
- sha256832e68e12ebf62b60cfe2a7b45e5948fcc364a74c8d73c3748b267617bcfb242Tax_Notice_23709.img IMG disk image from second India campaign (20 July 2026)
- sha25683d16cd963b1926a9967e6928340f099abf983ca496639cfddd9d63e327db3d2nvdahelperremote.dll malicious DLL used for DLL sideloading in second India campaign (20 July 2026)
- sha256aa8cda8a9a7835a72d1b832985c5976873d2c6e791524039b809ce4441d3f69fITDTAX202601987.zip ZIP attachment from third India campaign (22 July 2026)
- sha256da90b1219dcf1bf23e604b182b7737e188825df7205ea7b172231de66aeba293ITDTAX202601987.zip ZIP attachment from second India campaign (20 July 2026)
- sha256fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53SHA256 hash of 资料数据.exe initial PackClient loader executable from the May 2026 China campaign
- urlhxxp://154[.]36[.]188[.]98:8080/Sz9110[.]binURL used by Stage 1 loader to download encrypted PackClientLauncher payload from HFS server
Detection / Hunteropenrouter
What Happened
A new remote access tool called PackClient has been discovered being sold on Telegram and used by a threat group called TA4922. This group sent fake tax notices to organizations in China and India, tricking people into downloading what appeared to be tax documents. The downloaded files installed PackClient, which gives attackers full control of the victim's computer. The attackers can record keystrokes, take screenshots, access the webcam, steal files, and potentially intercept Telegram messages. Organizations in China and India have been targeted so far, but the malware is available for purchase, meaning other attackers may use it too. Organizations should train employees to be suspicious of unexpected tax notices and ensure their email filtering and endpoint security tools are updated to detect this threat.
Key Takeaways
- PackClient is a modular RAT and C2 framework sold on Telegram, used by Chinese-speaking threat actor TA4922 in at least three campaigns between May and July 2026.
- The malware uses a multi-stage loading chain: initial EXE drops xMain.dll, executes it via rundll32.exe, downloads and XOR-decrypts a launcher module, then reflectively loads the PackClientCore RAT DLL.
- PackClient supports over 60 C2 commands including keylogging, screen capture, clipboard manipulation, proxy tunneling, webcam capture, and a plugin system for dynamic feature expansion.
- The malware specifically targets Telegram Desktop processes and may deploy a plugin to inject proxy configuration into Telegram config files, enabling traffic interception.
- Later campaigns shifted to IMG disk images with DLL sideloading via Donut Loader, indicating the actor adapts delivery mechanisms.
Affected Systems
- Windows desktop systems (x86/x64)
- Telegram Desktop users on Windows
- Organizations with operations in mainland China (May 2026 campaign)
- Organizations in India (July 2026 campaigns)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Tax-themed phishing emails impersonating Chinese or Indian tax authorities deliver ZIP archives or links to attacker-controlled domains
- Execution: ZIP contains either a direct EXE (China campaign) or an IMG disk image with DLL sideloading via Donut Loader (India campaigns) to launch PackClient
- Persistence: Stage 1 loader sets HKCU RunOnce registry key (RuntimeBroker) pointing to %TEMP%\svchost.exe for autostart on next login
- C2: PackClient establishes raw TCP connections to hardcoded C2 endpoints on port 6666 using custom protocol with specific byte sequence headers (40 5a, PLH1, PLC1, PLA1, PLK1)
- Discovery: Core module enumerates running processes including AV/EDR products, Telegram, WeChat, and browsers; collects OS version, machine GUID, and system architecture
- Collection/Exfiltration: Keylogger, clipper, screen capture, file management, and Telegram interception plugins exfiltrate data to C2; additional plugins downloaded on demand
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Emerging Threats Suricata
Emerging Threats published multiple Suricata rules for PackClient detection including C2 checkin sequences (M1/M2), payload request/response, heartbeat, status checkin, information request, and desktop screen capture exfiltration. Additional generic hunting rules target .bin downloads from IP addresses, Rejetto HFS responses, and PE/DLL downloads over HTTP.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The malware uses rundll32.exe for execution and writes files to %TEMP% with masqueraded names like svchost.exe, which EDR can observe. However, reflective DLL loading into memory and the custom TCP protocol limit deeper visibility into post-compromise activity. |
| Network Visibility | Medium | C2 traffic uses raw TCP on port 6666 with identifiable byte sequences. Payload downloads use HTTP from IP addresses. Network detection depends on having visibility into outbound TCP 6666 connections and HTTP downloads from dotted-quad IPs. The custom protocol byte sequences are distinctive but may not be captured by standard network tools without Suricata rules. |
| Detection Difficulty | Moderate | The malware has several distinctive indicators including the rundll32.exe command line with xMain.dll and XMain export, the registry path HKCU\SOFTWARE\PackClientConsole, the process tree pattern (rundll32.exe -> svchost.exe -> svchost.exe --guard), and TCP 6666 C2 traffic. However, these indicators can be modified by the malware operator, and reflective loading reduces file-based detection. |
Required Log Sources
- Windows Sysmon Event ID 1 (Process Creation)
- Windows Sysmon Event ID 3 (Network Connection)
- Windows Sysmon Event ID 7 (Image Loaded - DLL loads)
- Windows Sysmon Event ID 11 (File Creation)
- Windows Sysmon Event ID 13 (Registry Value Set)
- Windows Security Event ID 4688 (Process Creation)
- EDR process tree and command line telemetry
- Network proxy or NGFW logs for outbound TCP 6666
- DNS resolution logs for gov12366.com, xzz.cam, backdoor.cyou
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for rundll32.exe executing DLLs from user-writable temporary directories with additional URL and IP parameters passed as command line arguments, which indicates a multi-stage loader receiving C2 configuration inline. | Sysmon Event ID 1 or EDR process creation logs with command line logging | Execution | Low - legitimate software rarely passes URLs and IP addresses as parameters to rundll32.exe executing temp directory DLLs |
| Consider hunting for svchost.exe processes executing from non-standard locations such as %TEMP% with a --guard command line parameter, which indicates PackClient's guardian process monitoring the main RAT process. | Sysmon Event ID 1 or EDR process creation logs with command line and image path fields | Persistence / Defense Evasion | Low - legitimate svchost.exe runs from System32 and does not accept --guard parameters |
| Consider hunting for registry keys created under HKCU\SOFTWARE\PackClientConsole, which is the malware's configuration storage location containing C2 host, port, group, and remark values. | Sysmon Event ID 13 (Registry Value Set) or EDR registry monitoring | Persistence / C2 Configuration | Very Low - this registry path is specific to PackClient and has no legitimate use |
| Consider hunting for outbound TCP connections on port 6666 from endpoint systems, particularly those preceded by HTTP downloads of .bin files from IP addresses, which indicates PackClient payload retrieval followed by C2 establishment. | NGFW or proxy logs, Sysmon Event ID 3, EDR network connection events | Command and Control | Medium - port 6666 is associated with some legitimate applications; correlate with process context |
| Consider hunting for RunOnce registry keys with values pointing to executables in temporary directories, which indicates PackClient's persistence mechanism masquerading as RuntimeBroker. | Sysmon Event ID 13 or Windows Security Event ID 4657 for registry value modifications | Persistence | Low - legitimate RunOnce entries rarely target %TEMP% paths |
Control Gaps
- Network-based detection may miss C2 traffic if port 6666 is changed by the operator to a common port like 443 or 80
- Reflective DLL loading into memory bypasses file-based AV scanning of the core module and plugins
- XOR decryption of the Stage 2 payload occurs in memory, limiting static file analysis
- Standard email filtering may not catch targeted tax-themed lures in regional languages (Chinese, Hindi)
- DLL sideloading via IMG disk images may bypass attachment filtering rules configured for traditional executable formats
Key Behavioral Indicators
- rundll32.exe executing DLLs from %TEMP% with URL and IP:port parameters in command line
- svchost.exe process running from %TEMP% with --guard command line parameter
- Process tree pattern: rundll32.exe -> svchost.exe -> svchost.exe --guard
- Registry key creation under HKCU\SOFTWARE\PackClientConsole with subkeys like s1_host, s1_port, device_uuid
- RunOnce registry value named RuntimeBroker pointing to %TEMP%\svchost.exe
- HTTP GET requests for .bin files from IP-address-based URLs (no domain)
- Rejetto HFS 2.4.0 RC8 server banner on non-standard ports
- Outbound TCP connections on port 6666 with custom protocol byte sequences (24 00 40 5a, 40 5a)
- nvdahelperremote.dll loaded in processes originating from mounted IMG files
False Positive Assessment
Low - the identified indicators are highly specific to PackClient including the registry path HKCU\SOFTWARE\PackClientConsole, the process tree pattern with --guard parameter, and the custom C2 protocol byte sequences. The main source of false positives would be port 6666 network detections if used by legitimate applications in the environment.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 IP addresses (154.36.188.98, 206.238.196.96, 64.81.30.99, 192.252.180.45, 154.36.188.201) and domains (gov12366.com, xzz.cam, backdoor.cyou) at your firewall or proxy.
- If your email gateway supports it, consider adding the identified phishing sender addresses and attachment patterns (tax-themed ZIP/IMG files) to blocklists or detection rules.
- Consider deploying the Emerging Threats Suricata rules referenced in the article to your IDS/IPS if you use that feed.
- If you have organizations with operations in China or India, consider prioritizing review of recent tax-themed phishing emails for indicators of this campaign.
Infrastructure Hardening
- Evaluate whether your email filtering rules can detect and block IMG disk image attachments, as these were used in the India campaigns to bypass traditional executable filtering.
- Consider implementing network egress filtering to block outbound TCP 6666 connections from endpoint systems where business justification does not exist.
- If your organization uses Rejetto HFS internally, consider replacing it with a supported file transfer mechanism, as the article notes this software is frequently abused by Chinese-nexus threat actors for payload hosting.
- Evaluate whether your DNS filtering covers the identified C2 domains (gov12366.com, xzz.cam, backdoor.cyou).
User Protection
- Consider updating endpoint detection rules to flag svchost.exe executing from %TEMP% or user profile directories, as this is a strong indicator of masquerading.
- If your EDR supports it, consider adding detection for rundll32.exe executing DLLs from temporary directories with network-related command line parameters.
- Evaluate whether your EDR can detect reflective DLL loading patterns associated with the PackClient loading chain.
- Consider monitoring for Telegram Desktop configuration file modifications on endpoints, as PackClient may inject proxy settings to intercept Telegram traffic.
Security Awareness
- Consider incorporating tax-themed phishing examples into existing awareness training programs, particularly for employees in China and India regions.
- If applicable to your workforce, consider reminding employees that legitimate tax authorities typically do not send enforcement notices with executable attachments or links to download documents from non-government domains.
- Consider briefing employees who use Telegram Desktop on the risk of traffic interception via proxy configuration injection, and advise them to verify Telegram connection settings periodically.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping16 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Ips:
154[.]36[.]188[.]201- Post-infection traffic destination observed in India campaign (15 July 2026)192[.]229[.]87[.]219- ManageEngine RMM server deployed by TA4922 several hours after initial PackClient infection (20 July 2026)
- Urls:
hxxp://154[.]36[.]188[.]98:8080/Sz9110.bin- URL used by Stage 1 loader to download encrypted PackClientLauncher payload from HFS server
- File Hashes:
7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a(SHA256) - Tax_Notice_23665.zip ZIP attachment from India campaign (15 July 2026)38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c(SHA256) - Tax_Notice_23665.img IMG disk image from India campaign containing DLL sideloading payload (15 July 2026)7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94(SHA256) - nvdahelperremote.dll malicious DLL used for DLL sideloading in India campaign (15 July 2026)da90b1219dcf1bf23e604b182b7737e188825df7205ea7b172231de66aeba293(SHA256) - ITDTAX202601987.zip ZIP attachment from second India campaign (20 July 2026)832e68e12ebf62b60cfe2a7b45e5948fcc364a74c8d73c3748b267617bcfb242(SHA256) - Tax_Notice_23709.img IMG disk image from second India campaign (20 July 2026)83d16cd963b1926a9967e6928340f099abf983ca496639cfddd9d63e327db3d2(SHA256) - nvdahelperremote.dll malicious DLL used for DLL sideloading in second India campaign (20 July 2026)aa8cda8a9a7835a72d1b832985c5976873d2c6e791524039b809ce4441d3f69f(SHA256) - ITDTAX202601987.zip ZIP attachment from third India campaign (22 July 2026)35712dc8aa497371ce48a36975781dfc3a120ce5c99dc209637b05751bf4e8e9(SHA256) - Tax_Notice_00481.img IMG disk image from third India campaign (22 July 2026)
- Registry Keys:
HKCU\SOFTWARE\PackClientConsole- Registry location where PackClient core module stores C2 configuration including host, port, group, remark, device UUID, and installation timestampHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\RuntimeBroker- Registry persistence key set by Stage 1 loader to execute %TEMP%\svchost.exe on next login
- File Paths:
%TEMP%\svchost.exe- Decrypted PackClientLauncher module written to disk by Stage 1 loader; masquerades as legitimate Windows svchost.exe%TEMP%\xMain.dll- DLL dropped by Stage 1 initial executable and executed via rundll32.exe with exported function XMain
- Command Lines:
- Purpose: Execute dropped xMain.dll loader module with C2 parameters | Tools:
rundll32.exe| Stage: Stage 1 execution |rundll32.exe "C:\Users\<user>\AppData\Local\Temp\xMain.dll",XMain - Purpose: Set registry persistence for PackClient launcher in RunOnce key | Tools:
reg.exe| Stage: Stage 1 persistence |reg add HKCU\...\RunOnce /v RuntimeBroker /t REG_SZ /d
- Purpose: Execute dropped xMain.dll loader module with C2 parameters | Tools:
- Other:
[email protected]- Sender email address used in May 2026 China campaign phishing email impersonating Shandong Provincial Tax Bureau[email protected]- Reply-to email address used in May 2026 China campaign phishing email[email protected]- Sender email address used in July 2026 India campaign phishing email impersonating Indian Income Tax Department[email protected]- Sender email address used in July 2026 India campaign phishing email impersonating Indian Income Tax Departmentca769c8641df35b671b2ce2dc31d7cac- ETag hash of Sz9110.bin payload file served by HFS server at 154.36.188.98:8080