Carry-On Compromise: TA4922 Packs PackClient

Proofpoint Threat InsightAugust 27, 2026Threat Intel

Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor, Chinese-speaking TA4922. With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem.

Summary from Proofpoint Threat Insight.

Read the full article at Proofpoint Threat Insight

Explained

The technology and terms in this story. Learn more

ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.

Carry-On Compromise: TA4922 Packs PackClient

Explained

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet