Skip to content
WhatsApp Malware Delivers VulcanRAT207.A with SYSTEM-Level Access

WhatsApp Malware Delivers VulcanRAT207.A with SYSTEM-Level Access

First seen 12 Oct 2026, 17:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 12, 2026 at 19:31 UTC
  • •VulcanRAT207.A gains SYSTEM-level access via a WhatsApp attachment.
  • •The malware employs sophisticated techniques like DLL sideloading and PoolParty Variant 7.
  • •Attackers can execute commands, manage files, and capture sensitive information from infected systems.

A malicious WhatsApp attachment is distributing a Windows remote access trojan (RAT) named VulcanRAT207.A, which can gain SYSTEM-level privileges. The attack begins with a ZIP archive containing a financial lure and an executable called Statement.exe. Once executed, the malware triggers a multi-stage infection chain that escalates privileges and injects code into the Windows Task Scheduler service. This allows the RAT to collect system information, execute commands, and manage files. The malware also employs a signed driver to terminate security processes and creates a scheduled task for persistence. The attack utilizes techniques such as DLL sideloading and PoolParty Variant 7 for code execution. The communication occurs over port 8888 with a remote server at 61[.]18[.]208[.]27. Current reports indicate ongoing exploitation of this malware campaign.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-08
Morphisec publishes analysis of VulcanRAT207.A
Morphisec details the multi-stage infection chain and techniques used by VulcanRAT207.A, including privilege escalation and code injection.
Morphisec
2026-10-12
The420.In reports on WhatsApp malware campaign
The420.In confirms the ongoing use of a malicious WhatsApp attachment to deliver VulcanRAT207.A, highlighting its capabilities and infection method.
The420.In

More articles in this cluster (2)

Following this threat?

Track RomulusLoader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 4

Common questions

How does the malware gain access?
The malware is delivered via a WhatsApp attachment that contains a ZIP file with a financial lure and an executable.
What systems are affected?
The malware targets Windows systems, leveraging the Windows Task Scheduler for privilege escalation.
What actions should be taken to mitigate this threat?
Users should avoid opening suspicious attachments and ensure security software is up-to-date to detect and block such threats.