- Proofpoint observed PackClient RAT sold on Telegram, used by group TA4922
- Attack spoofed tax authority emails in China and India, delivering PackClient installer
- RAT offers advanced features; researchers warn broader adoption likely beyond Asia
For almost three months, Chinese hackers have been distributing an advanced Remote Access Trojan (RAT) called PackClient, against organizations in mainland China and India.