TA4922 parks Donut Loader in the same folder as a signed executable

The load event carries the whole trick. Once the IMG is mounted, the process that runs is a legitimate executable, and the code that matters arrives as a DLL sitting in the same directory ^[5]. Read how the writeup phrases the endpoint telemetry it wants: a legitimate EXE loading a DLL from the same directory, after mounting an IMG ^[1]. That is a correlation across two events, not a signature on one file. If your endpoint tooling cannot express "image mount, then module load from the mount path", you do not have this detection. The analyst-side guidance asks for the same join from the other end, telling responders to investigate non-standard DLLs loaded by signed EXEs ^[2].

After that hop, nothing else needs to touch disk. Donut Loader unpacks PackClient into memory ^[6], and the report lists, among the conditions this campaign depends on, that EDR does not block that in-memory execution and that traffic reaches the C2 TCP port ^[10]. What executes, then, is one legitimate signed binary and two memory-resident payloads, which leaves the malicious DLL as the only attacker-supplied executable written to the endpoint ^[20].

The network indicators are thin by design of the format: 64.81.30.99 and 192.252.180.45:6666, alongside PackClient-specific handshakes, heartbeats and screenshot transfers ^[12]. A domain, gov12366[.]com, is listed for proxy and DNS logging ^[13]. For TCP/6666 to earn an alert in your environment, two things have to be true. You need to know which of your own services legitimately open non-web outbound TCP from user endpoints, and you need egress visibility on those endpoints rather than only on servers. Absent both, the port is trivia. The two addresses above are exactly this kind of line: current now, likely replaced by the operator's next build.

The timeline is worth the arithmetic. Late May in mainland China, mid-July in India, roughly seven weeks apart ^[18], with the RMM stage landing between 20 and 22 July, within about a week of the second lure wave ^[19]. Proofpoint rates the activity High on the basis of ongoing targeted campaigns across multiple regions with detailed C2 protocols ^[14]. The account here is a single writeup dated 27 August 2026 attributed to Proofpoint Threat Research, referencing MITRE ATT&CK's DLL Side-Loading entry ^[16]. It does not say whether the victim organisations already ran ManageEngine for their own administration, and that is the fact that decides how expensive the last mitigation on its list is ^[11].

One thing still gates the chain: a user has to open the ZIP or IMG and launch the executable ^[17]. The mail and gateway controls the report puts first ^[11] remain the cheapest stage to spend on, because they are the only ones acting before a signed process is already running attacker code.