Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to malware
MalwareUsed by 1 actor

SilentRunLoader

SilentRunLoader is a Python-based loader and information stealer, described in reporting as a compiled Python utility and a newer loader family used by TA4922, a Chinese-speaking and likely financially motivated threat actor. It was first identified in campaigns observed on 2026-03-30 and was used alongside other TA4922 tooling such as RomulusLoader, Atlas RAT, and Winos4.0/ValleyRAT.

Its primary documented capability is theft of Google Chrome data. Reported functionality includes harvesting stored credentials, session cookies, and browsing history or browsing information from Chrome, archiving stolen browser data into a ZIP file, and exfiltrating it to actor-controlled infrastructure. Multiple sources state that SilentRunLoader also downloads or drops an additional executable, including a next-stage payload identified as cg.exe. Proofpoint reported that it was installed via DLL sideloading in at least some campaigns and exfiltrated Chrome data to previously observed command-and-control infrastructure.

SilentRunLoader was deployed in phishing campaigns using localized social engineering lures, especially tax authority-, benefits-, and compliance-themed emails. High-confidence examples include HMRC or fake tax authority lures targeting organizations in the United Kingdom, as well as benefits and compliance-themed campaigns affecting recipients in the U.K. and Southeast Asia. Delivery methods mentioned in the content include DLL sideloading and links redirecting to MediaFire-hosted archives via shortened URLs.

The malware is associated with TA4922 campaigns targeting organizations in the United Kingdom and Southeast Asia, within a broader TA4922 victimology spanning East Asia, Europe, and South Africa. Reporting also notes code artifacts such as placeholder values and the unchanged string "your_secret_key_here," leading researchers to assess with high confidence that TA4922 likely used large language models to help accelerate development of this Python malware.

Known infrastructure and indicators directly tied to SilentRunLoader in the content include ws.ztts88.cyou, the upload path https://ws.ztts88.cyou/upload.php, resolved IP 18.139.83.110, and the payload name cg.exe.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TA4922

Another alarming component of the group’s toolkit is a compiled Python utility called SilentRunLoader. This stealthy program is designed to gather sensitive browser data from local machines.

via security online infosecurityonline.info
MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques
T1566PhishingEvidence3

In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader.

T1566.001Spearphishing AttachmentEvidence2

The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.

T1566.002Spearphishing LinkEvidence3

Once a victim clicks a link or opens an attachment, the malware silently installs itself.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1

Another alarming component of the group’s toolkit is a compiled Python utility called SilentRunLoader .

T1059.006PythonEvidence2

Proofpoint assessed with high confidence that the group likely uses AI coding tools to rapidly develop new Python-based malware.

Stealth

1 technique
T1218System Binary Proxy ExecutionEvidence1

The target receives a legitimate executable file and a malicious DLL (the Atlas RAT loader) that is sideloaded into the executable’s process.

Credential Access

2 techniques
T1539Steal Web Session CookieEvidence5

Specifically, it harvests saved credentials, session cookies, and local browsing histories directly from Google Chrome .

T1555Credentials from Password StoresEvidence5

Specifically, it harvests saved credentials, session cookies, and local browsing histories directly from Google Chrome .

Discovery

1 technique
T1217Browser Information DiscoveryEvidence1

Upon execution, the payload installed SilentRunLoader which harvested sensitive data from Google Chrome including stored credentials, cookies, and browsing information.

Collection

1 technique
T1560Archive Collected DataEvidence2

It then packs these data files into a zip archive and uploads them to a remote server .

Command and Control

2 techniques
T1071Application Layer ProtocolEvidence1

Atlas RAT ... connected to a command-and-control server at 206.238.115.58 over port 886... Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure.

T1105Ingress Tool TransferEvidence4

These campaigns delivered credential phishing, fraud, and a newly identified malware called Atlas RAT. New loader families, designated RomulusLoader and SilentRunLoader, were also introduced to stage additional tools. | New loader families, designated RomulusLoader and SilentRunLoader, were also introduced to stage additional tools.

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence3

It then packs these data files into a zip archive and uploads them to a remote server .

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence1

Collected data was exfiltrated via HTTP POST requests to C2 infrastructure hosted at “ws[.]ztts88[.]cyou” which resolved to IP address 18[.]139[.]83[.]110.

INDICATORS OF COMPROMISE

IOCs tracked for this family

22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
hash.sha256●●●●●●●●●●●●View more in app23 days ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching22

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.