VulcanRAT207.A (Morphisec, 7 Oct): WhatsApp ZIP / Statement.exe financial lure escalates to Windows SYSTEM via PoolParty injection, signed GoFly driver and WebSocket RAT on 61.18.208.27:8888
Morphisec (Shmuel Uzan, 7 October 2026) documents VulcanRAT207.A, a multistage Windows intrusion that starts as a WhatsApp attachment: a ZIP carrying a financial-document lure and Statement.exe. The outer executable is NRV2E-packed; after unpacking, the loader screens the host (disk, display, memory, CPU, event logs, Registry, VM markers, security products and timing checks), attempts privilege elevation, restores a clean ntdll.dll to drop user-mode hooks, and injects an importless downloader into the LocalSystem Task Scheduler process using PoolParty Variant 7 (thread-pool IoCompletion), so later stages inherit a SYSTEM token. The shellcode beacons over HTTP to 61[.]18[.]208[.]27:8888, validates a 0x0207 magic header, and receives a deployment bundle. A reflective loader maps a Deployment DLL that (1) installs GoFly64.sys — a legitimately signed Chinese network-filter driver — to terminate selected Baidu security processes, (2) writes a persistent Vulkan side-load package under C:\Program Files\Common Files and a scheduled task that later starts a signed VulkanInfo binary loading attacker-controlled vulkan-1.dll / vulkan-1.bin, and (3) launches the WebSocket RAT in memory for system data collection, command execution, file management, screen capture, keylogging, local account changes and further payloads. Morphisec published SHA-256 and network indicators for the Statement.exe / VulcanRAT207.A chain. No Australia-specific victims were named. Primary: Morphisec (7 Oct); wire: Cybersecurity News (12 Oct).
- Product
- Windows endpoints — VulcanRAT207.A (WhatsApp-delivered RAT chain)
- Versions
- n/a — malware campaign, not a product CVE
- Exploited in Australia?
- unknown
- Patch to
- Block or sandbox unexpected executables arriving via WhatsApp and other messaging apps; alert on Statement.exe, new services loading GoFly64.sys, VulkanInfo side-loading vulkan-1.dll from Common Files, and outbound HTTP/WebSocket to 61.18.208.27:8888. Hunt Morphisec's published SHA-256 indicators. Restrict WhatsApp Desktop file-open of ZIP/EXE on corporate endpoints where policy allows.
Primary: Morphisec — From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain (Shmuel Uzan, 7 Oct 2026) · Cybersecurity News — WhatsApp attachment deploys malware that gains SYSTEM access on Windows (12 Oct 2026)