Threat reportMalwareTL-2026-3343
WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task Scheduler (PoolParty Variant 7) to Run as SYSTEM
WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task (TL-2026-3343), also tracked as VulcanRAT207, is a high-severity malware campaign, first published 2026-10-12. It is attributed to TA4922 (China) with low confidence, affects Microsoft Windows (Task Scheduler service, x64), maps to 33 MITRE ATT&CK techniques (T1012, T1027.002, T1036.004), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 33MITRE ATT&CK
- Actors
- 1TA4922
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3343
- Threat ID
- TL-2026-3343
- Also known as
- VulcanRAT207, VulcanRAT207.A
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- TA4922
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 28
- Updates
- 2026-10-12 · revalidated 1× · latest source
Malware and tooling in WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task
Malware and tooling: VulcanRAT207.A, PoolParty Variant 7
How WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task works
A WhatsApp-delivered financial-document lure (Statement.exe) unpacks a multi-stage loader that elevates via COM auto-elevation, injects a downloader into the Task Scheduler service using PoolParty Variant 7, abuses the signed GoFly64.sys driver (BYOVD) to kill Baidu security processes, and side-loads vulkan-1.dll through the Intel-signed vulkaninfo-64.exe to run the WebSocket RAT VulcanRAT207.A as SYSTEM. Attribution to TA4922 is suspected by Morphisec but is not confirmed.
Morphisec (report dated 2026-10-07, covered by GBHackers on 2026-10-12 and The Hacker News ThreatsDay) documents an eight-stage intrusion chain that begins with a ZIP delivered over WhatsApp. The ZIP contains Statement.exe (wrapper sample name Tax-202609078869.exe), an NRV2E-compressed executable that reconstructs the real loader in memory without writing it to disk. WhatsApp delivery sidesteps email-security inspection.
The initial loader performs extensive host screening before any C2 contact: display dimensions via DirectDraw, system-drive size (>3 GiB), CPU and memory thresholds, display-device strings, LocalSystem/administrator token state, Security event log entries (IDs 4624 and 1102), registry markers (.NET, Hyper-V, IIS, PowerShell, virtualization keys), reparse-point state of ntdll.dll/kernel32.dll/user32.dll, and the presence of Baidu endpoint processes (HipsDaemon.exe, HipsTray.exe). Two 50 ms D3D11 timing gates act as anti-emulation checks, and eight integrity-check variants look for INT3/hook opcodes at function starts. The loader tries COM auto-elevation (CLSIDs {3AD05575-8857-4850-9277-11B85BDB8E09} and {BDB57FF2-79B9-4205-9447-F5FE85F37312}), falls back to ShellExecuteW with the runas verb, enables SeDebugPrivilege, and overwrites the .text section of ntdll.dll with the on-disk copy to remove user-mode hooks.
It then uses PoolParty Variant 7 (SafeBreach technique) to inject a downloader into the Windows Task Scheduler service host: it enumerates and duplicates handles from the target, finds the IoCompletion object, and queues a malicious TP_DIRECT callback with ZwSetIoCompletion instead of using CreateRemoteThread. The shellcode runs under the inherited LocalSystem token. This 3,192-byte position-independent downloader resolves APIs with a ROR13-plus-add hash and registers with the C2 at 61.18.208.27:8888 over HTTP using an empty User-Agent and a 50-byte XOR(0x3A)-protected header (registration ID 0x00013009, magic 0x02072024) followed by an RC4-variant-encrypted config. The server returns a bundle that is copied into RWX memory and executed.
A reflective loader maps a deployment DLL (headers stomped, Huffman-compressed) from a four-record bundle: vulkaninfo-64.exe, vulkan-1.dll, vulkan-1.bin, and a compressed configuration. The deployment DLL runs vulkan-1.bin from memory immediately, and in a separate path opens \\.\GoFly. If the device is missing, it writes the signed GoFly64.sys to %WINDIR%\System32\drivers\tp_<GetTickCount>.tmp, creates a SERVICE_SYSTEM_START service, and sends the PIDs of bdservicehost.exe and bduserhost.exe to IOCTL 0x12227A, which calls ZwTerminateProcess from ring 0. For persistence it writes vulkaninfo-64.exe, vulkan-1.dll and vulkan-1.bin (with randomized overlay data appended) to C:\Program Files\Common Files\ and registers a SYSTEM scheduled task named 'USOPrivate Kit' or 'USOPrivate' under \Microsoft\Windows\ (fallback \Microsoft\Windows\AppID). It adjusts behavior when 360Tray.exe or QQPCTray.exe/QQPCRTP.exe are running, uses the mutex Global\Admindllhost!!! in its dllhost.exe branch, and self-deletes if bdservicehost.exe terminates.
When the task runs, the genuine Intel-signed Khronos vulkaninfo-64.exe (v1.3.204.1, PE timestamp 2022-02-25) loads the malicious vulkan-1.dll from its own directory. On vkEnumerateInstanceVersion the DLL derives vulkan-1.bin from its own path, decompresses it, and executes it. The final VulcanRAT207.A decrypts its configuration with a ChaCha-derived 20-round cipher, uses the mutex analplug<suffix> (ExitProcess(123) on duplicate), opens \\.\pipe\<PID>_pipe, and connects by raw TCP to 61.18.208.27:8888, upgrading HTTP/1.1 to WebSocket v13 with a 50-byte custom header (magic 0x0207, command ID at offset 0x1E). Confirmed capabilities include victim profiling, shell sessions, file and registry management, event-log reading and clearing (ClearEventLogW), local account creation (added to Administrators) and password change, clipboard replacement, keylogging, DXGI/GDI screen capture with remote desktop control (PrivacyScreenClass window), WFP-based traffic blocking (NetstatBlockSession, BlockAllTrafficSession), download-and-execute, operator-supplied driver installation, and injection into explorer.exe or winlogon.exe (six injection variants).
Attribution: Morphisec reports overlap with the Vulkan-themed loader pattern (legitimate Vulkan executable, malicious vulkan-1.dll, vulkan-1.bin sidecar) that Proofpoint documented on 2026-06-03 for TA4922, a Chinese-speaking, financially motivated cybercrime cluster (RomulusLoader masquerading as Vulkan Loader). GBHackers states the reporting should not be treated as a confirmed attribution of this intrusion to TA4922. No CVE is associated; GoFly64.sys is a signed WFP network-filter driver (signer Nanjing Siyanrui Network Technology) with 20+ unauthenticated IOCTLs, listed in LOLDrivers and also distributed as PandaSpeed64.sys and drv_02581.sys. The Baidu, 360 and Tencent targeting suggests victims in Chinese-language environments, but the sources do not state victim geography or sectors. BeaconBeagle returned HTTP 404 for the C2 IP at research time, so no C2 correlation is recorded.
MITRE ATT&CK techniques used in TL-2026-3343
Discovery
T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1087.001 Account Discovery; T1518.001 Security Software Discovery
Defense Evasion
T1027.002 Software Packing; T1036.004 Masquerade Task or Service; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1480.001 Environmental Keying; T1497.001 System Checks; T1574.001 DLL; T1574.002 Hijack Execution Flow; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1098 Account Manipulation; T1136.001 Local Account; T1543.003 Windows Service
Privilege Escalation
T1055 Process Injection; T1134 Access Token Manipulation; T1548.002 Bypass User Account Control
Collection
T1056.001 Keylogging; T1113 Screen Capture
Execution
T1059.003 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573.001 Encrypted Channel
Lateral Movement
T1563.002 Remote Service Session Hijacking
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1686 Disable or Modify System Firewall
Affected products and versions in WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task
- Microsoft — Windows (Task Scheduler service, x64)
Vulnerable versions: Windows endpoints and servers reachable by the loader; no specific versions stated in sources
Remediation for WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task
Immediate actions
- Block and alert on outbound connections to 61.18.208.27:8888
- Hunt for scheduled tasks named 'USOPrivate Kit' or 'USOPrivate' under \Microsoft\Windows\ and \Microsoft\Windows\AppID
- Hunt for vulkaninfo-64.exe, vulkan-1.dll and vulkan-1.bin together in C:\Program Files\Common Files\
- Search for the file hashes listed in the IOCs and for Statement*.exe / Tax-*.exe delivered from WhatsApp or ZIP downloads
- Look for kernel-driver services with names like tp_<digits> and driver files tp_*.tmp in %WINDIR%\System32\drivers\
- Isolate hosts where the GoFly device (\\.\GoFly) or the mutexes Global\Admindllhost!!! / analplug* are present, and review local accounts created by the RAT
Workarounds
- Block or tightly control WhatsApp Web/Desktop file downloads on corporate endpoints where not required
- Set UAC to always notify to reduce reliance on COM auto-elevation
Longer-term hardening
- Enable the Microsoft vulnerable driver blocklist / HVCI and add GoFly64.sys (SHA-256 2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a) to WDAC or driver block rules
- Restrict execution of unsigned or user-writable-path executables received through messaging apps; apply ASR rules and application control
- Alert on service-host processes (Task Scheduler svchost) making outbound WebSocket upgrades or loading unexpected code
- Alert on security-product process termination and on ntdll.dll .text-section restoration
Timeline of WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task
- PE timestamp of the genuine Intel-signed Khronos vulkaninfo-64.exe (v1.3.204.1) later abused as the side-loading host
- GoFly64.sys (aliases PandaSpeed64.sys, drv_02581.sys), a signed WFP network-filter driver with roughly 20 unauthenticated IOCTLs, is added to the LOLDrivers catalogue, months before its use as the BYOVD process killer in this chain
- Proofpoint publishes its TA4922 report documenting Vulkan-themed loaders (RomulusLoader as Vulkan Loader, vulkan-1.dll and vulkan-1.bin sidecar) and WhatsApp as an out-of-band contact channel
- Outer wrapper filename Tax-202609078869.exe embeds 20260907, suggesting the lure was built around early September 2026 (inference from the filename, not a confirmed first-seen date)
- Morphisec publishes 'From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain' with full chain analysis and IOCs
- Threat ingested into the Threadlinqs platform as TL-2026-3343; campaign described as ongoing at the time of analysis
- GBHackers and The Hacker News ThreatsDay cover the WhatsApp-delivered VulcanRAT207.A campaign; GBHackers notes the TA4922 link is not a confirmed attribution
Update history for TL-2026-3343
- 2026-10-12 — VulcanRAT207.A Delivered via WhatsApp Attachment Gains SYSTEM Access on Windows via PoolParty Variant 7 Injection and Vulkan DLL Sideloading: What changed No severity, exploitability or status change (HIGH / ACTIVE / ACTIVE remain). Additive enrichment only. New indicators (10) 1 new filename (Tax-202609078869.exe) plus behavioral artifacts: tp_<tick driver service, Global\Admind
Sources cited for WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task
- From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain (Morphisec)
- WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM (GBHackers)
- ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories (The Hacker News)
- TA4922: Suspected Chinese Crime Group Going Global (Proofpoint)
- GoFly64.sys (LOLDrivers)
- PoolParty: process injection techniques abusing Windows thread pools (SafeBreach Labs)
- Process Injection Using Windows Thread Pools (SafeBreach)
- Add GoFlyDrv, LOLDrivers issue #299
Detection coverage for TL-2026-3343
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3343 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3343
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.