TA4922 cybercrime group expands attacks to Europe, Africa

A Chinese-speaking cybercrime group has significantly expanded its geographic targeting from its traditional base in East Asia to now include organizations in Europe and Africa, according to new research. The financially motivated actor, tracked as TA4922, is conducting a high volume of distinct campaigns using a rapidly evolving suite of malware and sophisticated, localized phishing lures.

The group, which cybersecurity firm Proofpoint assesses is likely focused on financial gain through data theft, fraud, and the resale of network access, has historically concentrated on Japan, Taiwan, Korea, Singapore, and India. In recent months, however, its campaigns have reached the United Kingdom, Germany, Italy, and South Africa. The actor runs more unique campaigns than any other cybercrime threat currently tracked by the company, demonstrating an unusually high operational tempo and variety in its methods.

TA4922’s attacks typically begin with carefully crafted phishing emails designed to impersonate local tax authorities, finance departments, and human resources teams. The lures are themed around routine business processes such as payroll updates, tax filings, invoices, and...