TA4922 uses PackClient malware in tax phishing attacks

Proofpoint researchers have identified a command-and-control framework called PackClient being used by Chinese-speaking threat actor TA4922 in attacks targeting organisations in China and India.

PackClient is a modular remote access trojan and command-and-control framework that supports surveillance, data theft and additional malware delivery. It appears to be sold through Chinese-language channels on Telegram.

Its discovery expands the known malware arsenal used by TA4922, which has previously used initial-access malware originating from the Chinese-speaking cybercrime ecosystem.

Tax lures

Researchers first identified PackClient in a TA4922 campaign targeting organisations with operations in mainland China.

Tax-themed emails impersonated the Shandong Provincial Tax Bureau and claimed recipients had been selected for a tax inspection. Recipients were asked to review documents concerning unpaid stamp duties.

Clicking a link directed recipients to an actor-controlled domain that delivered a ZIP archive containing an executable. Running the file initiated the PackClient installation process.

Proofpoint later observed at least two TA4922 campaigns deploying PackClient against organisations in India.

One campaign in mid-July used Hindi-language emails impersonating the Indian Income Tax Department. Messages alleged that recipients had underreported income and failed to disclose foreign assets, while threatening financial penalties.

Recipients received a ZIP archive containing an IMG disk image. When mounted, the image exposed an executable and malicious DLL.

DLL sideloading was then used to execute Donut Loader before PackClient was installed. Researchers observed post-compromise communications with attacker-controlled infrastructure.

TA4922 used the same infection chain in another campaign later that month. Emails again impersonated Indian tax authorities and used tax collection and penalty themes.

An attached ZIP archive contained an IMG file that delivered the malware. Command-and-control communications occurred over TCP port 6666.

Researchers also observed ManageEngine remote monitoring and management software being deployed several hours after the initial compromise.

Malware chain

PackClient uses several stages to establish itself on an infected Windows system.

First-stage execution downloads the next component and establishes persistence. A DLL is dropped to disk and executed using the Windows rundll32 utility.

PackClient then downloads an encrypted payload containing the PackClientLauncher module. After decrypting the payload, it writes the executable to the temporary directory.

A Windows registry RunOnce entry provides persistence before the executable is launched.

PackClientLauncher contacts its primary command-and-control server and downloads the PackClientCore module, which is loaded directly into memory.

A separate guard process monitors the malware and restarts PackClient if it is terminated.

Remote access

PackClientCore provides the framework's main remote access functions.

More than 60 commands support file management, surveillance, data theft and configuration changes. PackClient can also maintain simultaneous connections to two command-and-control servers.

Running processes can be enumerated, including security products, browsers and messaging applications such as Telegram and WeChat.

Keylogging and clipboard-monitoring functions are also included. Configuration and persistence data can be stored in the Windows registry.

Operators can execute shell commands, capture screens, establish proxy tunnels and access a victim's webcam. Other commands allow them to manage files, inspect running processes and download additional plugins or payloads.

PackClient's plugin architecture adds remote desktop access, file management, system administration, registry operations and interactive remote shells.

Other modules support webcam streaming, proxy tunnelling, Telegram interception and browser data theft.

Network activity

PackClient communicates with its infrastructure through HTTP and raw TCP connections.

After retrieving payloads, PackClientLauncher connects to its primary command-and-control server. PackClientCore can then exchange system information and instructions with the server.

Operators can receive information including the operating system version, machine identifier, local IP address, system architecture and configured command-and-control endpoints.

PackClient can also transmit thumbnail screenshots of a victim's desktop and send periodic heartbeat messages to maintain its connection.

Proofpoint has published detection guidance covering the malware's command-line behaviour, registry configuration, process tree and network communications.

Potential indicators include PackClient configuration data stored in the current user's Windows registry. Other signs include executables masquerading as legitimate Windows utilities in temporary directories and unusual communications over TCP port 6666.

Detection rules cover PackClient command-and-control check-ins, payload requests, heartbeat traffic, system information requests and desktop screen capture exfiltration.

PackClient appears to be marketed through Chinese-language Telegram channels. Proofpoint said additional Chinese-speaking threat actors may adopt the malware in future campaigns.