TA4922

Also known as Silver Fox, Void Arachne

Reports

First seen

Jun 3

Last seen

Jun 8

Motivation

financial, data_theft_fraud_access_resale, Financial (fraud, data theft, access sal

Top ATT&CK techniques

T1566 Phishing ×4T1219 Remote Access Software ×3T1056 Input Capture ×2T1005 Data from Local System ×2T1105 Ingress Tool Transfer ×2T1041 Exfiltration Over C2 Channel ×2T1218.011 System Binary Proxy Execution: Rundll32 ×1T1555 Credentials from Password Stores ×1T1113 Screen Capture ×1T1567 Exfiltration Over Web Service ×1T1218 System Binary Proxy Execution ×1T1571 Non-Standard Port ×1

Indicators

cve ×51domain ×1filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-27137 (exploited)CVE-2025-48595 (exploited)CVE-2026-28318 CVE-2026-39210 CVE-2026-39217

Recent reports

High

Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More

The Hacker NewsJun 8 High

China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

Proofpoint Threat InsightJun 4 High

China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa

The Hacker NewsJun 4 High

Chinese cybercrime group TA4922 expands to Europe with Atlas RAT and custom loaders

Bleeping ComputerJun 3

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.