TA4922 PackClient Attacks: From Tax Documents to DLL Side-Loading and RAT Deployment

1. Overview

• Article Title: Carry-On Compromise: TA4922 Packs PackClient
• Publisher: Proofpoint Threat Research
• Publication Date: August 27, 2026
• Source: Proofpoint Threat Research
• Related Source: MITRE ATT&CK - DLL Side-Loading
• Related Malware / Threat Groups / CVEs / Products: PackClient, Donut Loader, ManageEngine RMM, TA4922, Microsoft Windows
• Severity: High (Ongoing targeted campaigns across multiple regions with detailed C2 protocols)

2. Executive Summary

TA4922 used fake tax notices from China and India, delivering ZIP/IMG archives, performing DLL side-loading and Donut Loader execution to deploy the modular RAT "PackClient," and using custom TCP C2 and legitimate RMM tools for remote endpoint control.

3. Attack Flow

Tax-Themed Delivery Targeting China and India

1. In late May 2026, organizations operating in mainland China received emails disguised as tax audits from Shandong Province. The emails directed users to click a link and download a ZIP file hosted on an attacker-controlled domain.
2. In mid-July 2026, emails disguised as Indian income tax refunds and tax notices instructed users to open an IMG file inside a ZIP archive.
3. The IMG file contained a legitimate executable and a malicious DLL in the same folder, triggering Donut Loader via DLL side-loading.
4. Donut Loader unpacked PackClient into memory and connected to a hard-coded C2 server using a custom TCP protocol.
5. In campaigns between July 20 and 22, the attackers deployed ManageEngine remote management tools after PackClient execution.

4. Threat Actor Positioning and Execution Locations

• External email sender disguised as tax and regulatory authorities.
• Remotely controls compromised endpoints from the PackClient operational infrastructure after initial execution.

5. Victim and Administrator Perspectives

Victims

• Prompted to open links or compressed files that appear to be tax documents, income tax refunds, or regulatory notices. ### Administrators
• Can observe the attack chain: Email → ZIP → IMG → Legitimate EXE and Malicious DLL → Donut Loader → PackClient.
• Key indicators include hard-coded C2 servers (including TCP/6666), screenshots, keyloggers, and subsequent RMM tools.

6. Success and Failure Conditions

Success Conditions

• The target downloads the archive from the link and executes the binary inside the IMG file.
• DLL search order hijacking succeeds, and EDR does not block the in-memory execution of Donut Loader and PackClient.
• Network traffic successfully reaches the C2 TCP port. ### Failure Conditions / Risk Mitigation
• Block external tax-themed links and archive/disk image files via email and Secure Web Gateways (SWG).
• Detect and block DLL side-loading from user-writable directories and in-memory loaders.
• Control unknown outbound TCP traffic and the installation of remote management tools.

7. Impact of Successful Compromise

• Remote control via PackClient, including screen capture, keylogging, and process monitoring.
• Persistent endpoint manipulation using additional payloads or legitimate RMM tools.
• Data theft and subsequent compromises targeting organizations involved in tax-related operations.

8. Observable Logs

• Email: Tax and refund themes, external download links, ZIP/IMG delivery.
• Proxy/SWG/DNS: gov12366[.]com, known C2 servers, archive downloads, traffic to unknown IPs.
• Endpoint/EDR: Legitimate EXE loading a DLL from the same directory after mounting an IMG, DLL side-loading, Donut Loader, PackClient Launcher/Core.
• Identity/IdP: Correlate subsequent authentications from compromised endpoints with endpoint risk.
• SaaS/Cloud: Monitor subsequent access utilizing stolen information.
• Network: 64[.]81[.]30[.]99, 192[.]252[.]180[.]45:6666, PackClient-specific handshakes/heartbeats, and screenshot transfers.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Contact with tax-themed emails, links, or archives only, with no evidence of execution.
• User Interaction Confirmed: The user opened the ZIP/IMG and launched the executable.
• Malware Execution or Authentication Success Confirmed: Confirmed PackClient C2 handshake or operational commands.
• Subsequent Compromise Confirmed: Confirmed use of ManageEngine RMM, additional modules, data collection, or remote control.

10. Investigation Playbook

• Trigger: Detect PackClient IOCs, tax lures, DLL side-loading, or custom TCP communication.
• Initial Triage: Preserve emails, URLs, ZIP/IMG files, executables, DLLs, process lineage, memory images, and network traffic.
• Endpoints: Investigate non-standard DLLs loaded by signed EXEs, Donut Loader, PackClient modules, keylogging, and screen capture activity.
• Identity and Cloud: Check authentications and sessions associated with compromised endpoints, and revoke them if necessary.
• Post-Exploitation: Check for ManageEngine RMM, additional payloads, internal reconnaissance, and data access.
• Containment: Isolate endpoints, block IOCs, reset credentials, remove RMM tools, and reimage systems if necessary.
• Confidence Levels: Differentiate between email contact, user execution, loader execution, C2 establishment, and post-exploitation.

11. Defense and Detection Ideas

• Single Events: A signed EXE inside an IMG file loads an adjacent DLL, immediately followed by in-memory payload execution.
• Time-Series Correlation: Correlate tax emails -> archives -> disk images -> DLL side-loading -> outbound TCP -> RMM deployment.
• Threat Hunting: Cross-search for PackClient markers such as PLH1/PLC1, heartbeats, TCP/6666, and keylogger/screenshot behaviors.
• Log Gaps: Disconnected email URLs, disk images, module loads, memory telemetry, and network packets make it difficult to determine the attack chain.
• Priority Mitigations: Control archives and disk images; monitor DLL loads and memory execution; restrict unknown RMM tools and outbound TCP traffic.

12. Facts / Inference / Hypothesis

Facts

• Proofpoint observed TA4922 delivering PackClient in late May and July 2026.
• PackClient is a modular RAT consisting of a loader, launcher DLL, core, and plugins.
• DLL side-loading and Donut Loader were used in the July campaign targeting India.
• PackClient uses raw TCP sockets and hard-coded C2 servers. ### Inference
• The attackers tailor regional lures around tax procedures to target document delivery vectors that are commonly opened in business environments.
• Deploying legitimate RMM tools after PackClient allows them to maintain access even if malware-specific IOCs are burned. ### Hypothesis
• The same PackClient infrastructure could be expanded to other regions and tax themes.

13. MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link (High): Distributes archives via email body links.
• T1204.002 User Execution: Malicious File (High): Prompts targets to launch executables inside IMG files.
• T1574.002 Hijack Execution Flow: DLL Side-Loading (High): Loads malicious DLLs from legitimate executables.
• T1219 Remote Access Software (Medium): Deploys ManageEngine RMM in subsequent stages.

14. Unknowns and Further Investigation

• The number of confirmed victim organizations and the scope of data theft.
• The operational relationship between the PackClient developer and TA4922.
• The active operational status of all plugins and C2 commands.

15. Impact on SOCs

Tax and regulatory notices are frequently opened themes in corporate environments. SOCs must monitor archives, disk images, DLL side-loading, and unauthorized RMM installations as a correlated time series rather than as isolated events.

16. Summaries by Role

• For SOCs: Correlate events from tax emails to disk images, DLL side-loading, PackClient C2, and RMM tools.
• For Administrators: Restrict archive/IMG execution, unknown DLLs, unnecessary outbound TCP traffic, and unauthorized RMM tools.
• For End Users: Do not open compressed files or disk images obtained from tax notice links; verify them through official channels.