Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 2 actors

Atlas RAT

Atlas RAT is a recently identified modular remote access trojan/backdoor used by TA4922, a Chinese-speaking and likely financially motivated threat actor. It has been deployed in phishing-driven campaigns observed in March and April 2026, including HR-, business-, and invoice-themed lures targeting organizations in Japan, the United Kingdom, Germany, and other regions. Delivery observed in the reporting relied on DLL sideloading from archive files hosted on services such as GoFile, including campaigns using malicious DLLs such as libcef.dll. Atlas RAT is described as a multi-stage, full-featured backdoor in which a final core module and auxiliary plugins are downloaded from command-and-control infrastructure.

Reported capabilities include system reconnaissance and harvesting of broad system specifications, arbitrary command execution, targeted file theft and file upload, plugin and payload download, keylogging, screenshot capture, clipboard theft, audio recording, webcam/video capture, and system shutdown or reboot commands. The malware also performs anti-sandbox and anti-analysis checks, including checks for WDAGUtilityAccount, CExecSvc, the DNS suffix mshome, the vmsmb device, Windows activation indicators, and the WDAG RunOnce registry key before enabling functionality. One report states it uses direct syscalls via SysWhispers to load shellcode and retrieve its core module, and another states it uses ChaCha encryption for command-and-control communications.

Atlas RAT has been associated primarily with TA4922, though other reporting cited in the content notes overlap with Silver Fox and refers to Atlas RAT as also known as AtlasCross RAT. Observed command-and-control infrastructure for Atlas RAT campaigns includes 206.238.115.58 over TCP port 886 and 154.211.86.110 over TCP port 886. High-confidence filenames and artifacts mentioned in the content include libcef.dll and campaign archive names such as "【給与調整のお知らせ】.zip," "Paperwork.zip," "HR (2).zip," and "電子請求書発行のお知らせ.zip."

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TA4922

For high-value targets, the threat group deploys Atlas RAT, a full-featured modular backdoor trojan. This advanced payload can harvest broad system specifications and execute arbitrary commands.

via security online infosecurityonline.info
Silver Fox

TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems.

via dark readingdarkreading.com
MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques
T1566PhishingEvidence4

The attacker relied primarily on human resources and business-themed lures to target victims. These campaigns delivered credential phishing, fraud, and a newly identified malware called Atlas RAT.

T1566.001Spearphishing AttachmentEvidence2

The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.

T1566.002Spearphishing LinkEvidence3

Once a victim clicks a link or opens an attachment, the malware silently installs itself.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1

Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.

T1106Native APIEvidence1

The shellcode stub resolves its required Windows function addresses. It also resolves several native API functions like ZwAllocateVirtualMemory...

Privilege Escalation

1 technique
T1055Process InjectionEvidence1

RomulusLoader starts one or more “workers”, which are effectively copies of its code that are injected into other processes (such as svchost.exe and dllhost.exe).

Stealth

4 techniques
T1055Process InjectionEvidence1

RomulusLoader starts one or more “workers”, which are effectively copies of its code that are injected into other processes (such as svchost.exe and dllhost.exe).

T1218System Binary Proxy ExecutionEvidence1

The target receives a legitimate executable file and a malicious DLL (the Atlas RAT loader) that is sideloaded into the executable’s process.

T1497Virtualization/Sandbox EvasionEvidence3

Before activating these features, the backdoor runs several complex environmental checks . It verifies whether the host environment belongs to an automated analysis sandbox . Specifically, it checks for built-in sandbox names like WDAGUtilityAccount or virtualization flags like mshome . If the environment appears unsafe, the malware instantly terminates its execution to evade signature generation .

T1497.001System ChecksEvidence1

The Atlas RAT loader DLL runs several interesting anti-sandbox and anti-analysis checks... If any of these checks fail, the malware assumes it’s running in a hostile environment and terminates itself.

Credential Access

1 technique
T1056.001KeyloggingEvidence4

For example, the tool can record surrounding audio, capture webcam feeds, log keystrokes, and steal clipboard data .

Discovery

5 techniques
T1082System Information DiscoveryEvidence3

This advanced payload can harvest broad system specifications and execute arbitrary commands .

T1083File and Directory DiscoveryEvidence2

Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.

T1120Peripheral Device DiscoveryEvidence1

The malware also checks for a camera as well as the audio (recording and output) devices on the endpoint and sends this data to the C2.

T1497Virtualization/Sandbox EvasionEvidence3

Before activating these features, the backdoor runs several complex environmental checks . It verifies whether the host environment belongs to an automated analysis sandbox . Specifically, it checks for built-in sandbox names like WDAGUtilityAccount or virtualization flags like mshome . If the environment appears unsafe, the malware instantly terminates its execution to evade signature generation .

T1497.001System ChecksEvidence1

The Atlas RAT loader DLL runs several interesting anti-sandbox and anti-analysis checks... If any of these checks fail, the malware assumes it’s running in a hostile environment and terminates itself.

Collection

6 techniques
T1005Data from Local SystemEvidence1

Proofpoint’s report highlights Atlas RAT, a recently identified remote access trojan that offers attackers the following capabilities: ... Targeted file theft

T1056.001KeyloggingEvidence4

For example, the tool can record surrounding audio, capture webcam feeds, log keystrokes, and steal clipboard data .

T1113Screen CaptureEvidence3

Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.

T1115Clipboard DataEvidence2

For example, the tool can record surrounding audio, capture webcam feeds, log keystrokes, and steal clipboard data .

T1123Audio CaptureEvidence3

For example, the tool can record surrounding audio, capture webcam feeds, log keystrokes, and steal clipboard data .

T1125Video CaptureEvidence4

For example, the tool can record surrounding audio, capture webcam feeds, log keystrokes, and steal clipboard data .

Command and Control

3 techniques
T1071Application Layer ProtocolEvidence1

Atlas RAT ... connected to a command-and-control server at 206.238.115.58 over port 886... Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure.

T1105Ingress Tool TransferEvidence4

These campaigns delivered credential phishing, fraud, and a newly identified malware called Atlas RAT. New loader families, designated RomulusLoader and SilentRunLoader, were also introduced to stage additional tools.

T1219Remote Access ToolsEvidence1

TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems, or legitimate remote monitoring and management (RMM) software, like AnyDesk. In the latter case, it'll use a loader called RomulusLoader to bring the RMM onto the host system.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

Atlas RAT has the following capabilities: List and upload files to the C2 server (data exfiltration)

Impact

1 technique
T1529System Shutdown/RebootEvidence1

Proofpoint’s report highlights Atlas RAT... System shutdown/reboot commands

INDICATORS OF COMPROMISE

IOCs tracked for this family

22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching22

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.