TA4922 Atlas RAT: Screen Capture to Temp Dir Correlated with C2 Exfil

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

Detects instances where a process, other than known benign applications, writes a screen capture image file (BMP, JPG, JPEG, or PNG) to a temporary directory, followed by a network connection to an external IP address within two minutes by the same process.