TA4922 PackClient RAT Campaign Threat Hunt

Threat Overview

Proofpoint published new research on August 27, 2026 describing PackClient, a modular remote-access and command-and-control framework actively used by the Chinese-speaking threat actor TA4922 and apparently marketed to other actors through Telegram.

Observed campaigns used tax-themed phishing in China and India. Delivery chains included ZIP and IMG archives, DLL sideloading, rundll32.exe execution of xMain.dll, a staged %TEMP%\svchost.exe payload, RunOnce persistence, a separate -guard process that restarts the core RAT, raw TCP C2, and later deployment of ManageEngine RMM.

References

• Proofpoint — Carry-On Compromise: TA4922 Packs PackClient — August 27, 2026
• Proofpoint — TA4922: The Suspected Chinese Crime Group is Going Global — June 3, 2026

Impacted Systems

Platform	Windows endpoints
Threat actor	TA4922; Proofpoint notes PackClient also appears to be sold to other actors
Initial access	Tax/compliance-themed phishing with ZIP/IMG archives and malicious executables/DLLs
Execution	DLL sideloading and rundll32.exe loading xMain.dll; staged executables under %TEMP%
Persistence	HKCU RunOnce value RuntimeBroker; separate -guard process
C2	Raw TCP; observed ports include 6666; HTTP staging from Rejetto HFS also observed
Post-compromise	Remote shell, screen capture, proxying, keylogging, browser-data enumeration, plugin/payload delivery, ManageEngine RMM
Targeting observed	Organizations with operations in mainland China and organizations in India
Known activity	Confirmed observed campaigns by Proofpoint

What this hunt looks for

Looks for the PackClient process tree (rundll32 → temp svchost.exe → svchost.exe -guard), RunOnce persistence, suspicious xMain.dll execution, and raw TCP C2 activity.

Required logs

DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents; optionally EmailEvents/EmailAttachmentInfo where Defender for Office 365 telemetry is available.

First-Pass — PackClient rundll32 / xMain.dll Pattern

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "xMain.dll" and ProcessCommandLine has "XMain"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Follow-Up — Temp svchost.exe With PackClient Guard Flag

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "svchost.exe"
| where FolderPath has_any (@"\Temp\",@"\AppData\Local\Temp\")
| where ProcessCommandLine has "-guard" or InitiatingProcessCommandLine has_any ("xMain.dll","XMain")
| project TimeGenerated, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Follow-Up — PackClient RunOnce Persistence

DeviceRegistryEvents
| where TimeGenerated >= ago(30d)
| where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\RunOnce"
| where RegistryValueName =~ "RuntimeBroker"
| where RegistryValueData has_any (@"\Temp\svchost.exe",@"\AppData\Local\Temp\")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated asc

Follow-Up — Raw TCP 6666 From Suspicious Temp Processes

DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemotePort == 6666
| where InitiatingProcessFileName in~ ("svchost.exe","rundll32.exe")
| where InitiatingProcessFolderPath has_any (@"\Temp\",@"\AppData\Local\Temp\") or InitiatingProcessCommandLine has_any ("xMain.dll","-guard")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated asc