CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

PackClient

tool · tool:packclient single-source

Modular remote-access trojan / C2 framework sold on Telegram; four-stage rundll32 + reflective-DLL-loading delivery chain, registry RunOnce persistence, config stored at HKCU\\SOFTWARE\\PackClientConsole, dual-channel custom TCP C2 protocol (PLH1/PLC1 handshakes). Deployed by China-nexus actor TA4922 in tax-themed campaigns against mainland China and India (Proofpoint, 2026-08-27).

Coverage
1
first 2026-08-28 → last 2026-08-28
Latest activity
2026-08-28
A China-nexus financially-motivated cluster already tracked for EU expansion picks up a commodity…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, finance · regions: apac, europe
Sources cited
2
2 hosts

Defender insights

What each entry about PackClient tells a defender to do, newest first.

2026-08-28NOTABLEA China-nexus financially-motivated cluster already tracked for EU expansion picks up a commodity, Telegram-proliferated RAT

Triage

Story timeline

  1. 2026-08-28TA4922 adds PackClient, a Telegram-sold modular RAT/C2 framework, to its toolkit, dual-channel C2, registry-resident configuration, and tax-themed lures against mainland China and India
    active-threatsA China-nexus financially-motivated cluster already tracked for EU expansion picks up a commodity, Telegram-proliferated RAT

Hunting pivots

Tags
infostealerorganized-crimephishing
ATT&CK techniques (5 across 6 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • PersistenceBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • StealthReflective Code Loading
  • Credential AccessInput Capture: Keylogging
  • CollectionInput Capture: Keylogging · Screen Capture
  • Command and ControlIngress Tool Transfer

Persistence TA0003

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

Privilege Escalation TA0004

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

Stealth TA0005

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

Credential Access TA0006

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

Collection TA0009

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

T1113Screen Capture×1

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-08-28/ta4922-packclient-telegram-rat-tax-lures · ATT&CK page ↗

Entries about PackClient (1)

2026-08-28 · view entry permalink →

NOTABLENATOB2

TA4922 adds PackClient, a Telegram-sold modular RAT/C2 framework, to its toolkit, dual-channel C2, registry-resident configuration, and tax-themed lures against mainland China and India

Proofpoint documents PackClient, a modular remote-access trojan and command-and-control framework actively sold on Telegram, now in use by TA4922, an already-tracked China-nexus, financially-motivated cluster, previously associated with Atlas RAT, RomulusLoader and SilentRunLoader and reported in June as expanding its targeting to the UK, Germany, Italy and South Africa (The Hacker News, 2026-06-04). Proofpoint writes that "with this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem" (Proofpoint, 2026-08-27).

PackClient's delivery chain uses rundll32 execution and reflective DLL loading, with persistence via a registry RunOnce key, and stores its configuration under HKCU\SOFTWARE\PackClientConsole. Proofpoint's hunting guidance lists, as separate items, a "Distinct Rundll32 command line used to launch PackClient.", "PackClient config stored in registry (HKCU\SOFTWARE\PackClientConsole\)." and a "Distinct process tree and command line flags" (Proofpoint, 2026-08-27). It supports keylogging, webcam and screen capture, file exfiltration and plugin/payload management over dual C2 channels using a custom TCP protocol with distinctive handshake byte sequences (Proofpoint names them PLH1/PLC1): "PackClient is a full featured, modular command and control (C2) framework that supports data theft, surveillance, and downloading of additional plugins and payloads" (Proofpoint, 2026-08-27).

In the observed campaigns TA4922 used tax-themed phishing lures against organisations in mainland China and India, with post-compromise activity that included deploying ManageEngine remote-monitoring-and-management tooling, a legitimate RMM abused for continued access, consistent with this actor's established pattern of using commodity or legitimate management tools post-compromise. Proofpoint does not name a MITRE ATT&CK technique explicitly, but the described behaviours map to registry Run-key persistence, DLL side-loading/reflective loading defence evasion, and collection via keylogging and screen capture.

The campaign targeting is mainland China and India, not this constituency's home region or profiled sectors directly, but the relevance rests on two points: TA4922 was reported in June 2026 as expanding its targeting to the UK, Germany, Italy and South Africa (The Hacker News, 2026-06-04), so a new Telegram-proliferated C2 framework in this actor's toolkit is transferable tradecraft to watch for; and a MaaS tool sold on Telegram is not exclusive to one actor and may surface again against a different, more directly-relevant target set. Triage: a registry key at HKCU\SOFTWARE\PackClientConsole on any endpoint has no legitimate application association and is a direct compromise indicator; process trees showing rundll32 launched with non-standard command-line flags followed by reflective DLL-loading behaviour (no corresponding file on disk for the loaded module) are the discriminator against ordinary rundll32 usage, which normally loads a named, on-disk DLL export.

With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem.

PackClient is a full featured, modular command and control (C2) framework that supports data theft, surveillance, and downloading of additional plugins and payloads.

Distinct Rundll32 command line used to launch PackClient.

PackClient config stored in registry (HKCU\\SOFTWARE\\PackClientConsole\\).

Distinct process tree and command line flags

Proofpoint 2026-08-27

Builds on: Proofpoint TA4922: a China-nexus cybercrime cluster expands from Japan into Germany, the UK and…

threat28 Aug 06:38Zsingle-sourceOpen finding →
Sources: Proofpoint · The Hacker News

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • proofpoint.com1 (50%)
  • thehackernews.com1 (50%)
All cited sources (2)