TA4922 Atlas RAT/RomulusLoader C2, DNS, Suspicious Net and Payload Hash

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects activity associated with the TA4922 (Silver Fox) threat actor, specifically involving Atlas RAT and RomulusLoader. The detection logic utilizes four primary telemetry sources: network connections to known C2 IP addresses, DNS queries for the 'srt.tw' domain, suspicious outbound connections from user-writable directories (AppData, Temp, etc.) over non-standard ports, and the execution of a specific malicious ZIP archive file identified by its SHA256 hash.