Attack Chain

1. TA4922 sends spearphishing emails with tax-inspection notices, directing users to download a ZIP archive containing an executable or an IMG disk image.
2. The user executes a payload or mounts the IMG, initiating a DLL sideloading process (e.g., using a legitimate library like nvdahelperremote.dll).
3. A Stage 1 loader is executed, which checks for elevated permissions, decrypts an embedded Stage 2 payload, and writes it to disk (e.g., %TEMP%\svchost.exe).
4. The loader establishes persistence by adding an entry to the HKCU RunOnce registry key.
5. The Stage 2 "PackClientLauncher" module is executed, which contacts a hardcoded C2 server to download the Stage 3 "PackClientCore" module.
6. The core module is reflectively loaded into memory and initialized using a configuration found in the .rdata section or registry.
7. A secondary guard process is spawned with the '--guard' flag to monitor the main process and perform auto-restart if terminated.
8. The attacker deploys follow-on tools, such as ManageEngine RMM, to maintain persistent remote access and exfiltrate data.

Impact

TA4922 campaigns have targeted government, financial, and enterprise entities in China and India. Successful compromise grants the actor full remote control, including surveillance capabilities, keylogging, and the ability to download arbitrary secondary payloads. This facilitates long-term espionage and unauthorized access to sensitive financial and corporate data.

Recommendation

• Deploy the provided Sigma rule to detect the unique PackClient process tree and guard process behavior.
• Block the actor-controlled infrastructure domains (gov12366[.]com) and IPs at the organization's perimeter DNS and firewall.
• Monitor for unauthorized execution of ManageEngine RMM binaries in environments where they are not officially managed by IT.
• Implement restrictive policies on mounting IMG files and executing unsigned binaries from the %TEMP% directory.