61.18.208.27

IP Address

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

October 8, 2026

Last Seen

October 12, 2026

IOC Validation

ThreatCluster AI

Confirmed IOC — High confidence

Communicates with VulcanRAT207.A as a C2 server

This indicator was confirmed as a true IOC by AI analysis.

Pivot to external tools

Opens in new tab · no data sent to TC

Reputation · 4

Sandbox · 2

Infrastructure · 3

Malware trackers · 1

Web search · 2

Related Clusters (1)

WhatsApp Malware Delivers VulcanRAT207.A with SYSTEM-Level Access

6h ago·2 sources

Related Articles (2)

WhatsApp Attachment Deploys Windows Malware With SYSTEM-Level Access

The420.In·6h ago

From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain

Morphisec·4d ago

Related Entities

Malware CWE-94 - Code Injection VulcanRAT207.A RomulusLoader T1053 - Scheduled Task/Job T1055 - Process Injection T1071 - Application Layer Protocol T1543.003 - Windows Service T1574 - Hijack Execution Flow T1566.001 - Spearphishing Attachment T1059 - Command and Scripting Interpreter Windows