Chinese Hackers Deploy PackClient RAT via Tax-Themed Phishing Attacks to Steal Data

Severity

Medium

Detail

Proofpoint threat researchers have disclosed details regarding PackClient, a commercial remote access trojan (RAT) framework deployed by Chinese-speaking threat actor TA4922. Marketed on Chinese-language Telegram channels, PackClient provides extensive initial-access and post-exploitation capabilities, including credential theft, surveillance, data exfiltration, and lateral movement. In campaigns observed between May and July 2026, TA4922 targeted organizations across mainland China and India using regulatory tax enforcement lures.

The group leverages multi-stage execution pathways—incorporating spoofed domain hosting, ISO/IMG disk images, DLL sideloading, in-memory reflective execution, and post-compromise Remote Monitoring and Management (RMM) tools—to bypass security perimeters and establish persistent control.

How?

TA4922 employs regional social engineering techniques paired with multi-stage execution chains to deliver the modular PackClient framework.

In May 2026, the group targeted organizations in mainland China by impersonating the Shandong Provincial Tax Bureau, citing uncollected stamp duties and alleging failure to comply with a 2026 tax inspection. Victims were directed to download 数据资料.zip from gov12366[.]com, an actor-controlled spoof domain designed to mimic legitimate government tax portals. Executing 资料数据.exe launched a downloader that dropped xMain.dll, executed it via rundll32.exe, and downloaded an encrypted payload written to disk as %TEMP%\svchost.exe. The malware secured persistence via a Windows RunOnce registry key.

In July 2026, TA4922 shifted its focus to Indian organizations, using Hindi-language emails purporting to be from the Indian Income Tax Department. The emails alleged tax evasions or undisclosed foreign assets and attached malicious archives (Tax_Notice_23665.zip, ITDTAX202601987.zip) containing IMG disk image files. When mounted, the image file exposed a legitimate binary and a malicious DLL, triggering a DLL sideloading sequence that executed Donut Loader to install PackClient.

Upon initial access, the loader (PackClientLauncher) reflectively loads PackClientCore directly into system memory. PackClient stores operational configurations—including C2 IP addresses (64.81.30.99 and 192.252.180.45), port assignments (such as TCP 6666), and campaign IDs—in HKCU\SOFTWARE\PackClientConsole\.

The core framework supports over 60 commands, including keylogging, process enumeration, screenshot capture, webcam access, and Telegram Desktop configuration tampering. It also executes a secondary protective process with the argument svchost.exe –guard to auto-restart the core RAT if killed. Within hours of compromise, TA4922 was observed deploying ManageEngine RMM software to facilitate interactive post-exploitation operations.

Conclusion

The deployment of PackClient demonstrates TA4922’s expanding operational reach and highlights the risks posed by commercial RAT frameworks available on Telegram marketplaces. Organizations must combine email filtering with endpoint behavioral analysis to stop multi-stage infection routines before attackers deploy secondary remote administration tools.

To mitigate this threat, security teams should block external emails containing high-risk container attachments (.zip, .img, .iso) and filter web access to unverified tax-themed domains such as gov12366[.]com. EDR rules should be configured to flag rundll32.exe executing DLLs from user temporary directories (%TEMP%, %APPDATA%) and alert on process arguments containing svchost.exe –guard.

Additionally, security teams must audit Windows RunOnce and Run registry keys referencing executables running outside standard system directories, enforce application allowlisting policies to block unauthorized deployments of RMM solutions such as ManageEngine, and monitor outbound network traffic on non-standard ports—specifically TCP 6666 and connections to C2 infrastructure (64[.]81[.]30[.]99 and 192[.]252[.]180[.]45).

Source

https://gbhackers.com/chinese-hackers-deploy-packclient-rat/