New PackClient RAT sold on Telegram

A new advanced Remote Access Trojan (RAT) known as PackClient is being sold on Telegram channels and has been used by the financially motivated hacking group TA4922 to target organizations in China and India, based on information published by Tech Radar.

The PackClient RAT, observed by Proofpoint, offers a wide range of capabilities including file theft, remote shell execution, screen capture, and keylogging. Since late May, TA4922 has been distributing the malware by spoofing tax authority emails in China and India, tricking recipients into downloading what they believed to be tax paperwork, which was actually the PackClient installer. While Proofpoint did not specify the number of victims or their industries, TA4922 has historically targeted small to medium-sized organizations in East Asia and has recently expanded its reach to Europe and the UK.

Researchers warn that the broad availability of PackClient on Telegram makes it likely that other threat actors will adopt it for future campaigns, potentially increasing its deployment against organizations globally.

Source: Tech Radar