WhatsApp ZIP Delivers VulcanRAT207.A That Gains Windows SYSTEM

Morphisec says a WhatsApp financial-document lure drops VulcanRAT207.A, which reaches SYSTEM on Windows via Task Scheduler injection and Vulkan DLL sideloading.

Morphisec, covered by GBHackers and Cyber Security News on 12 October 2026, analyzed a WhatsApp ZIP that delivers VulcanRAT207.A as a fake financial statement; Cyber Security News names the packed file Statement.exe and says it checks for sandboxes, while GBHackers says the chain unpacks in memory, profiles the host, and elevates via COM auto-elevation. Both report PoolParty Variant 7 injection into the Windows Task Scheduler service so later stages run as SYSTEM, and a signed GoFly64.sys driver that can kill Baidu security processes; GBHackers adds IOCTL 0x12227A and says SYSTEM is obtained without a second local privilege escalation. Persistence is described as side-loading vulkan-1.dll via a signed VulkanInfo binary—GBHackers names vulkaninfo-64.exe and vulkan-1.bin under Common Files—plus a SYSTEM scheduled task called USOPrivate Kit by GBHackers and USOPrivate or USOPrivate Kit by Cyber Security News. The host 61.18.208.27 on port 8888 is cited by both, as the WebSocket RAT C2 in GBHackers and as a bundle download source in Cyber Security News. Capability lists disagree: GBHackers reports recon, shell, clipboard, RDP, and screen capture, while Cyber Security News reports shells, screen capture, keylogging, and account changes. Only GBHackers mentions possible, unconfirmed links to TA4922 Vulkan-themed campaigns.

• Morphisec analyzed the campaign; GBHackers and Cyber Security News both reported it on 2026-10-12.
• A WhatsApp ZIP poses as a financial statement and drops VulcanRAT207.A; Cyber Security News names the packed loader Statement.exe and says it checks for sandboxes.
• PoolParty Variant 7 thread-pool injection into the Windows Task Scheduler service lets later stages run as SYSTEM/LocalSystem; GBHackers says this follows COM auto-elevation and needs no second local privilege escalation.
• A signed GoFly64.sys driver is abused to terminate Baidu endpoint-security processes; only GBHackers cites IOCTL 0x12227A.
• Persistence uses vulkan-1.dll side-loaded by a signed VulkanInfo binary (GBHackers: vulkaninfo-64.exe, plus vulkan-1.bin under Common Files) and a SYSTEM scheduled task named USOPrivate Kit; Cyber Security News also allows the name…
• Both cite 61.18.208.27 port 8888, but GBHackers calls it the WebSocket RAT C2 while Cyber Security News says a bundle is downloaded from that address.
• RAT features disagree: GBHackers lists recon, shell, clipboard, RDP, and screen capture; Cyber Security News lists shells, screen capture, keylogging, and account changes.
• Only GBHackers notes possible but unconfirmed links to TA4922 Vulkan-themed campaigns.