From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain

The VulcanRAT207.A intrusion chain begins with a WhatsApp-delivered lure containing Statement.exe, which uses NRV2E compression to hide its payload. After host screening, it attempts privilege escalation via COM-based methods and injects code into the Windows Task Scheduler process running as LocalSystem using PoolParty Variant 7 injection. A downloader shellcode fetches a compound bundle deployed through a reflective loader. The deployment stage uses a signed GoFly driver to terminate Baidu security processes and establishes persistence through DLL side-loading with a legitimate Intel-signed VulkanInfo executable. The final payload is a WebSocket-based remote access trojan providing shell access, keystroke capture, desktop control, network filtering, and process injection, maintaining SYSTEM-level persistence.

This malware achieves SYSTEM-level privilege escalation, allowing it to disable security software, maintain persistence, and perform extensive surveillance and control over the infected host. It can capture keystrokes, control the desktop, filter network traffic, and inject code into processes, posing a significant threat to confidentiality, integrity, and availability of the affected systems.

No official patch or remediation is indicated in the provided data. Defenders should rely on updated endpoint detection and response solutions capable of detecting the described techniques such as COM-based privilege escalation, PoolParty injection, DLL side-loading, and the use of signed malicious drivers. Blocking the initial WhatsApp-delivered lure and monitoring for indicators of compromise such as the listed hashes and IP address can aid in prevention and detection.