Prior work and contributions
Public reporting
Proofpoint's Carry-On Compromise: TA4922 Packs PackClient documented the campaign's Tax Notice lineage, PackClient's Launcher/Core architecture, representative PLH1, PLC1, PLA1, PLK1, and PV10 markers, and the associated Emerging Threats coverage.
Deception.Pro's New PackClient & HOK (Aug 2026) documented later PackClient activity and the attacker's use of compromised ManageEngine infrastructure.
Pre-existing public artifacts
The MalwareBazaar campaign ZIP provides the public Tax Notice lineage examined in the Launcher architecture.
Three public Triage analyses supplied historical runtime and network evidence:
260715-wd77daas7lcontains successful Launcher authentication, Core delivery, post-delivery commands, andPV10screenshot traffic.260716-dhnz7aft6zcontains another successful session delivering the same Core build.260828-py7ysahr4yrecords the suspendedSysWOW64\svchost.exe, remote package placement, and primary-thread context hijacking used to start the injected chain.
What this research adds
| Area | Contribution |
|---|---|
| Launcher transport | Recovered the outer framing, message-type gates, complete PLH1/PLC1/PLA1 handshake, 42-byte authentication transcript, authenticated AES-256-CBC receive order, and PLK1 delivery logic. |
| Core recovery | Reconstructed a 985,088-byte x86 PackClientCore.dll directly from historical PLK1 traffic and confirmed that all eight complete transfers produce the same DLL. The recovery includes the eleven ordered type-0x15 chunks, raw-LZ4 decompression, and plaintext SHA-256 verification. |
| Execution chain | Connected the signed host's imported carrier entry point to a suspended SysWOW64\svchost.exe, the remotely placed Donut package, unmanaged executable A, Launcher B, and the delivered Core. The Donut loader, embedded instance, terminal glue, and A-to-B mapping contract were also recovered. |
| PackClient Core | Mapped all 11 exports, the Launcher-to-Core ABI, six local settings, Core-specific type-0x16 encryption, staged plugin delivery and cache behavior, DPAPI-protected Core updates, ETCHOOK clipboard replacement, major command handlers, and the built-in PV10 screenshot producer. |
| Screenshot paths | Reconstructed the worker-side 1RCP interface, including its five-DWORD header and top-down BGRX framebuffer. Core's separate PV10 JPEG producer was also recovered; no direct bridge between the two paths was established. |
| Session continuity | Recovered active-session selection, token handling, bootstrap construction, process-creation retries, and session-drift replacement logic. |
| Persistence | Two September sandbox runs distinguished the normal full-EXE scheduled-task path from the direct-DLL rundll32.exe behavior produced by sandbox execution. |
| Defensive tooling | Added passive Launcher/Core stream decoding, verified PLK1 and PV10 extraction with provenance manifests, a phase-aware Wireshark Lua dissector, synthetic protocol fixtures, engine-backed regression tests, and separate Launcher/Core YARA rules. |
Artifact identities and supporting observations are collected in Evidence. Remaining unknowns and limits are documented in Scope and limitations.