Carry-On Compromise: TA4922 Packs PackClient

Summary

TA4922, a Chinese-speaking threat actor, is using a new modular C2 framework called PackClient. The malware is advertised on Telegram and supports data theft, surveillance, and remote access. Recent campaigns have targeted organizations in China and India through tax-themed phishing lures.

Investigation

Proofpoint researchers identified PackClient through malware observability within the Deception Pro environment. The investigation traced several infection chains, including DLL sideloading and delivery through IMG disk images. Analysis revealed a multi-stage execution flow involving a downloader, a launcher component, and the final PackClient core RAT module.

Mitigation

Organizations should monitor for suspicious rundll32.exe command lines and unusual persistence through the RunOnce registry key. Strict controls should be applied to executable downloads from untrusted domains, while unauthorized RMM software deployment should be closely monitored. Inspecting network traffic for custom TCP protocols on non-standard ports such as 6666 can also improve detection.

Response

If PackClient activity is detected, the affected host should be isolated immediately to stop further C2 communication and data exfiltration. Responders should perform memory forensics to identify the injected PackClientCore module and search for the associated guardian process. Registry keys under HKCU\SOFTWARE\PackClientConsole and system logs should also be reviewed for unauthorized ManageEngine RMM activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully deployed the PackClient RAT on a compromised Windows workstation. To establish command and control, the malware attempts to reach out to its hardcoded C2 infrastructure. The attacker’s goal is to receive instructions for data exfiltration and further lateral movement. We will simulate this by initiating a socket connection to one of the malicious IPs (206.238.196.96) on the specific port (6666) defined in the detection rule to verify the SIEM triggers an alert.

• Regression Test Script:

  # Simulation of PackClient C2 communication attempt
  $C2_IP = "206.238.196.96"
  $C2_PORT = 6666
  
  Write-Host "Attempting to simulate PackClient C2 connection to $C2_IP on port $C2_PORT..."
  
  try {
      $tcpClient = New-Object System.Net.Sockets.TcpClient
      $connection = $tcpClient.BeginConnect($C2_IP, $C2_PORT, $null, $null)
      $wait = $connection.AsyncWaitHandle.WaitOne(5000, $false)
  
      if (-not $wait) {
          Write-Host "Connection timed out (expected if IP is unreachable, but telemetry should still be generated)." -ForegroundColor Yellow
      } else {
          Write-Host "Connection successful (Unexpected for simulation)." -ForegroundColor Red
      }
      $tcpClient.Close()
  } catch {
      Write-Host "Connection failed as expected: $($_.Exception.Message)" -ForegroundColor Green
  }

• Cleanup Commands:

  # No persistent artifacts are created by this network-only simulation.
  Write-Host "Simulation cleanup complete. No files or registry keys were modified."