VulcanRAT207.A: WhatsApp-Delivered BYOVD Intrusion Chain

Attacker objective: remote, interactive control of Windows endpoints with SYSTEM authority, after first blinding the endpoint security products installed on them. Morphisec (Shmuel Uzan, published 2026-10-07) traces a multi-stage intrusion that starts with a financial-document lure, reportedly delivered over WhatsApp as Statement.exe inside a ZIP, and ends in a WebSocket remote access trojan that Morphisec tracks as VulcanRAT207.A. The Hacker News ThreatsDay bulletin of the same week summarizes the report.

How it works: the loader screens the host, attempts elevation, then uses PoolParty Variant 7 to place a downloader inside the Task Scheduler service host without CreateRemoteThread. Everything that follows inherits that LocalSystem token. A deployment DLL then does three things: it installs the signed GoFly64.sys driver and sends it the process IDs of Baidu security processes (bdservicehost.exe, bduserhost.exe) so the driver kills them from ring 0; it starts the RAT directly from memory; and it writes a persistent Vulkan DLL side-loading package (vulkaninfo-64.exe, vulkan-1.dll, vulkan-1.bin) to C:\Program Files\Common Files with a SYSTEM scheduled task named USOPrivate Kit or USOPrivate to bring the RAT back.

Commodity tooling, handled accordingly: GoFly64.sys is a legitimately Authenticode-signed Chinese network-filter driver, catalogued on LOLDrivers and abused by unrelated actors. vulkaninfo-64.exe is a genuine Intel-signed Khronos build, and its hash is shared with a separate package (port 1234) that this pack does not cover. Neither is a unique marker of this campaign, so both ship detect only, matched by behavior and placement rather than by identity.

Defender angle: the durable signals are the component boundaries Morphisec recommends correlating: a Vulkan host sitting in Common Files, a USOPrivate SYSTEM task, a tp_-named driver staged under System32\drivers, and the VulkanInfo process making network connections or spawning children. The hard parts are blind to a host sensor: the PoolParty injection into Task Scheduler, the memory-resident RAT, the GoFly IOCTL itself, and the Windows Filtering Platform filters. The Coverage Map flags each as a gap.

Scope: this pack covers the Statement.exe and VulcanRAT207.A chain only. Morphisec describes a related port 1234 package leading to RomulusLoader and a different RAT as a separate follow-up article. No RomulusLoader indicator is shipped here.

Defender priority: run Q1, Q3, Q4, Q5, Q6 and Q12 over 30 days first (near-zero FP, no indicator dependency). Run Q13 for host-level correlation. Then enable the ASR rule that blocks abuse of exploited vulnerable signed drivers in audit mode (section 12, I1).

Web Hunter decisions and discrepancies

• Delivery channel is hedged by the source. Morphisec says the lure "reportedly" arrived over WhatsApp as a ZIP attachment. This pack repeats the hedge and does not state WhatsApp delivery as confirmed.
• The Hacker News adds no indicators. Its section is a paraphrase of Morphisec, so no IOC counts as two-source on its strength. The only item with a genuine second source is GoFly64.sys (LOLDrivers), and it is commodity tooling, so it ships hunt only.
• The VulkanInfo host hash is shared. Morphisec states the hash is shared with the separate port 1234 package. It identifies a stock Intel-signed binary, so it is used only together with SYSTEM context (Q2) and is not imported as an IOC.
• Unverified blocklist status. No fetched source states whether GoFly64.sys is on Microsoft's vulnerable driver blocklist. The hardening section therefore says to test it in audit mode rather than assuming coverage.
• HVCI wording. LOLDrivers records the sample as HVCI FALSE with no sample confirmed loading despite HVCI. The pack treats that as encouraging but unproven for your fleet.
• Related cluster excluded. The port 1234 package and RomulusLoader are explicitly out of scope; no indicator for them is shipped.
• Page extras ignored. The Morphisec and Hacker News pages carry navigation, promotional and unrelated-news text (including a bulletin item about prompt injection in phishing emails). None of it was addressed to this agent, none asked for any action, and none was used.
• No injected instructions. Every fetched page was scanned for text directed at an automated agent. None was found.

Hypotheses (ordered by fidelity)

Attack chain

Hunt hint: a host sensor sees the artifacts around the loader but not the loader. Treat the Vulkan trio, the USOPrivate task and the tp_ driver as the three durable footprints and look for any two together (Q13). The RAT command table includes 0x22000 (inject into explorer.exe) and 0x10002 (forward to the GoFly device); neither has a verified Falcon event.

Every atomic indicator below appears in the saved snapshot 01-morphisec-vulcanrat207.txt; the GoFly64.sys file names and commodity status are corroborated by 03-loldrivers-gofly64.txt. All are detect. None is set to prevent: the campaign values are single-sourced to Morphisec, and the two commodity items are legitimate signed binaries.

Not shipped: the RAT configuration key and nonce quoted in the report, and every indicator of the port 1234 RomulusLoader package. Key material is not a detection indicator, and the other package is a different cluster.

Mitigation M-codes for T1068, T1685, T1543.003, T1053.005, T1574.001 and T1055 were read from the saved MITRE snapshots (06 to 11). Rows marked "Not mapped from a saved page" were not checked against a saved MITRE page and carry no M-code.

Hunts that need no CQL. Several are the only way to see stages the Falcon sensor cannot.

N1 · Filesystem and task sweep (read-only)

Run on any suspect host or through RTR. It checks for the Vulkan trio, the staged driver, the USOPrivate task and tp_ services.

# Vulkan side-load package under Common Files
Get-ChildItem 'C:\Program Files\Common Files' -Include vulkaninfo-64.exe,vulkan-1.dll,vulkan-1.bin -Recurse -Force -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256 | Select-Object Path, Hash

# Staged driver files and tp_ driver services
Get-ChildItem "$env:WINDIR\System32\drivers" -Filter 'tp_*.tmp' -Force -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime
Get-CimInstance Win32_SystemDriver | Where-Object { $_.Name -like 'tp_*' -or $_.PathName -like '*\drivers\tp_*.tmp' } | Select-Object Name, State, StartMode, PathName

# USOPrivate scheduled task or any task running the Vulkan host
Get-ScheduledTask | Where-Object { $_.TaskName -like '*USOPrivate*' -or ($_.Actions.Execute -like '*vulkaninfo-64.exe') } |
  Select-Object TaskPath, TaskName, @{n='Run';e={$_.Actions.Execute}}, @{n='User';e={$_.Principal.UserId}}

N2 · Windows event cross-reference

• Security 4698 (scheduled task created, needs auditing on): task name containing USOPrivate under \Microsoft\Windows or \Microsoft\Windows\AppID.
• System 7045 (service installed): service name tp_ followed by digits, image under System32\drivers ending .tmp, type kernel driver, start type system.
• CodeIntegrity Operational: a load or audit of GoFly64.sys or a .tmp driver image. Event 3099 only confirms that a block policy is active (Microsoft Learn).
• Sysmon (if deployed): Event ID 6 (driver loaded) for GoFly64.sys, Event ID 1 for vulkaninfo-64.exe with a SYSTEM user, Event ID 7 (image load) of vulkan-1.dll from Common Files by vulkaninfo-64.exe, Event ID 17 or 18 for pipe <PID>_pipe.

N3 · Mutex and pipe hunt on a live host

With a handle-enumeration tool, look for the mutexes Global\Admindllhost!!! and one starting with analplug, and for a named pipe called <PID>_pipe where the number equals its owning process ID. These are runtime artifacts and are not visible in CQL.

N4 · Network hunt for TCP 8888

In firewall or NetFlow data, search for the C2 address on any port, then for long-lived TCP sessions from SYSTEM-context processes to unfamiliar public hosts on 8888 that start with an HTTP request and continue as WebSocket frames. Without TLS, an HTTP Upgrade: websocket to a bare IP is a strong signal; this is behavior drawn from the report's description and should be validated on your sensors.

N5 · Security product health check

The chain kills security processes. For each managed endpoint, alert on a security-product service or process that stopped without an administrator action, and compare it to sensor heartbeat gaps. This applies to any EDR or AV, not only the Chinese products Morphisec names.

Events and fields were checked against the crowdstrike-logscale-v3 references. Queries marked "Field unverified" depend on scheduled-task and service fields that vary by sensor version: run each event filter alone with count() over 24 hours first (gate G1). No query uses a driver-load, module-load or mutex event, because none is verified in the reference.

// HUNT: vulkaninfo-64.exe executing from Program Files\Common Files (side-load host placement)
// MITRE: T1574.001, T1036.005
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ImageFileName
// SOURCE: Morphisec VulcanRAT207.A (Stage 6, vulkaninfo-64.exe in Common Files)
// FALSE POSITIVES: none expected; a legitimate VulkanInfo is not installed under Common Files
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^vulkaninfo-64(\.exe)?$/i
| ImageFileName=/\\Program Files( \(x86\))?\\Common Files\\vulkaninfo-64\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

// HUNT: VulkanInfo (by name or published host hash) running as SYSTEM outside a Vulkan SDK folder
// MITRE: T1574.001, T1053.005
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2 with ImageFileName, UserSid
// SOURCE: Morphisec VulcanRAT207.A (task runs vulkaninfo-64.exe as SYSTEM; host hash in IOC table)
// FALSE POSITIVES: GPU diagnostics or RMM tooling that runs VulkanInfo as SYSTEM
// TUNING: exclude your RMM or driver-management parent on a named asset group, for example | ParentBaseFileName!=/^(YourRmmAgent)\.exe$/i, and keep the query unfiltered elsewhere
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^vulkaninfo(-64)?(\.exe)?$/i OR SHA256HashData=facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116
| UserSid="S-1-5-18"
| ImageFileName!=/\\VulkanSDK\\/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

// HUNT: Vulkan side-load package PE written under Program Files\Common Files
// MITRE: T1574.001, T1036.005
// CONF: high | FP: low | COST: low | REQUIRES: PeFileWritten or NewExecutableWritten with TargetFileName
// SOURCE: Morphisec VulcanRAT207.A (deployment DLL writes the Vulkan triplet to Common Files)
// FALSE POSITIVES: none expected; Vulkan runtime installers write vulkan-1.dll to System32, not Common Files
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\Program Files( \(x86\))?\\Common Files\\(vulkan-1\.dll|vulkaninfo-64\.exe)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid], limit=200)

// HUNT: scheduled task USOPrivate / USOPrivate Kit or task that launches the Vulkan side-load host
// MITRE: T1053.005
// CONF: high | FP: low | COST: low | REQUIRES: ScheduledTaskRegistered with TaskName and TaskExecutable (validate in tenant)
// SOURCE: Morphisec VulcanRAT207.A (Stage 5, task registration via Task Scheduler COM APIs)
// FALSE POSITIVES: none expected; Windows Update Orchestrator tasks are named UpdateOrchestrator style, not USOPrivate
// LOOKBACK: 30d
#event_simpleName=ScheduledTaskRegistered
| TaskName=/USOPrivate/i OR TaskExecutable=/\\Common Files\\vulkaninfo-64\.exe/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecutable, aid], limit=200)

// HUNT: PE staged as System32\drivers\tp_<tick>.tmp (BYOVD driver staging)
// MITRE: T1068, T1543.003
// CONF: high | FP: low | COST: low | REQUIRES: PeFileWritten or NewExecutableWritten with TargetFileName
// SOURCE: Morphisec VulcanRAT207.A (driver staged to tp_<GetTickCount>.tmp)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\System32\\drivers\\tp_[0-9]+\.tmp$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid], limit=200)

// HUNT: service created from System32\drivers\tp_<tick>.tmp
// MITRE: T1543.003, T1068
// CONF: high | FP: low | COST: low | REQUIRES: CreateService with ServiceImagePath (validate in tenant)
// SOURCE: Morphisec VulcanRAT207.A (service tp_<GetTickCount>, SERVICE_SYSTEM_START)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=CreateService
| ServiceImagePath=/\\System32\\drivers\\tp_[0-9]+\.tmp/i OR ServiceDisplayName=/^tp_[0-9]+$/i
| table([@timestamp, ComputerName, UserName, ServiceDisplayName, ServiceImagePath, aid], limit=200)

// HUNT: service created from a .tmp driver image or a .sys in a user-writable path (generic BYOVD staging)
// MITRE: T1068, T1543.003
// CONF: medium | FP: medium | COST: low | REQUIRES: CreateService with ServiceImagePath (validate in tenant)
// SOURCE: Morphisec VulcanRAT207.A (operator-supplied driver written to a tp_ .tmp path); generic behavior
// FALSE POSITIVES: driver installers and imaging or OEM tools staging .sys files in temporary folders
// TUNING: exclude your deployment tool by parent or by signer-approved path on named assets, for example | ServiceImagePath!=/\\ProgramData\\YourVendor\\/i
// LOOKBACK: 30d
#event_simpleName=CreateService
| ServiceImagePath=/\\drivers\\[^\\]+\.tmp$|\\(Users|ProgramData|Temp)\\.*\.sys$/i
| table([@timestamp, ComputerName, UserName, ServiceDisplayName, ServiceImagePath, aid], limit=200)

// HUNT: campaign-specific SHA-256 sweep (WhatsApp wrapper, Statement loader, deployment bundle)
// MITRE: T1204.002
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten with SHA256HashData
// SOURCE: Morphisec VulcanRAT207.A (IOC table, SHA-256 values)
// FALSE POSITIVES: none (exact hash match)
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field="SHA256HashData", values=["0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb", "be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9", "6833b1946ac219cf6ddf6cfbde1f81352b12d9125c8735961b5256216c4fdc49", "cbf8ffe904a030c02b9def094f609b2c05a78fa5c7745d2d371d38dd460c58be"])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, aid], limit=200)

// HUNT: GoFly64.sys vulnerable driver sighting by LOLDrivers file name (commodity tooling, detect only)
// MITRE: T1068
// CONF: medium | FP: medium | COST: low | REQUIRES: PeFileWritten or NewExecutableWritten with TargetFileName
// SOURCE: Morphisec VulcanRAT207.A (GoFly64.sys) and LOLDrivers GoFly64.sys entry (alias file names)
// FALSE POSITIVES: a legitimate install of the GoLink or PandaSpeed product that ships this driver
// TUNING: exclude the specific hosts that run the vendor product after confirming the install is sanctioned, for example | !in(field="aid", values=["REPLACE_WITH_AID_1"]); keep it unfiltered elsewhere
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(GoFly64|PandaSpeed64|drv_02581)\.sys$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, ImageFileName, SHA256HashData, aid], limit=200)

// HUNT: outbound connection to the VulcanRAT207.A C2 address
// MITRE: T1071.001
// CONF: high | FP: low | COST: low | REQUIRES: NetworkConnectIP4 with RemoteAddressIP4
// SOURCE: Morphisec VulcanRAT207.A (C2 61[.]18[.]208[.]27:8888)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="61.18.208.27"
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

// HUNT: vulkaninfo host process making network connections (post side-load RAT C2)
// MITRE: T1071.001, T1574.001
// CONF: high | FP: low | COST: low | REQUIRES: NetworkConnectIP4 with ContextBaseFileName
// SOURCE: Morphisec VulcanRAT207.A (RAT runs inside vulkaninfo-64.exe on the persistent route)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^vulkaninfo(-64)?(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

// HUNT: process spawned by vulkaninfo / vulkaninfo-64.exe (RAT shell and operator actions)
// MITRE: T1059.003, T1574.001
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName
// SOURCE: Morphisec VulcanRAT207.A (redirected cmd.exe shell, tscon, operator actions)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^vulkaninfo(-64)?(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

// HUNT: correlate VulcanRAT207.A chain signals per host (two or more distinct signals)
// MITRE: T1574.001, T1053.005, T1543.003, T1071.001
// CONF: high | FP: low | COST: medium | REQUIRES: PeFileWritten, NewExecutableWritten, ScheduledTaskRegistered, CreateService, NetworkConnectIP4
// SOURCE: Morphisec VulcanRAT207.A (defensive considerations: correlate component boundaries)
// FALSE POSITIVES: very low; each signal is rare on its own
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ScheduledTaskRegistered|CreateService|NetworkConnectIP4)$/
| case {
    #event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ | TargetFileName=/\\Common Files\\(vulkan-1\.dll|vulkaninfo-64\.exe)$/i | Signal := "vulkan_package_write";
    #event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ | TargetFileName=/\\System32\\drivers\\tp_[0-9]+\.tmp$/i | Signal := "driver_staging";
    #event_simpleName=ScheduledTaskRegistered | TaskName=/USOPrivate/i | Signal := "usoprivate_task";
    #event_simpleName=CreateService | ServiceImagePath=/\\drivers\\tp_[0-9]+\.tmp/i | Signal := "tp_service";
    #event_simpleName=NetworkConnectIP4 | RemoteAddressIP4="61.18.208.27" | Signal := "c2_address";
    * | Signal := "none";
  }
| !in(field="Signal", values=["none"])
| groupBy([aid, ComputerName], function=[count(Signal, distinct=true, as=DistinctSignals), collect([Signal], limit=10), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000)
| DistinctSignals>1
| sort(DistinctSignals, order=desc, limit=200)

Four queries are clean enough to promote from hunt to Custom IOA. All four are detect only. The pack recommends no prevention action anywhere: campaign indicators are single-sourced to Morphisec, and the two commodity items (GoFly64.sys, vulkaninfo-64.exe) are legitimately signed binaries whose blocking by hash or name would break production and miss reuse by other actors.

Pattern syntax follows the Custom IOA regular-expression fields. Confirm the exact escaping in your console before saving, then create each rule in Monitor on a pilot policy for one business week. The campaign hashes and the C2 address belong in IOC Management (section 10) as detect, not in IOAs.

Not recommended as IOAs: Q2 (SYSTEM VulkanInfo is noisy where RMM tools run it), Q7 (generic driver staging), Q9 (commodity driver, context required), Q4 and Q6 (field population varies by sensor version), Q13 (correlation, better as a scheduled search).

Blocks tuned to this campaign. The CSV is the only block meant for import: it holds the five campaign-specific values, every one traced to snapshot 01-morphisec-vulcanrat207.txt. The commodity items are deliberately kept out of it.

type,value,action,severity,expiration,description,tags
sha256,0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb,detect,medium,2027-04-09,Tax-202609078869.exe WhatsApp wrapper,campaign:VulcanRAT207.A
sha256,be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9,detect,medium,2027-04-09,Packed Statement.exe,campaign:VulcanRAT207.A
sha256,6833b1946ac219cf6ddf6cfbde1f81352b12d9125c8735961b5256216c4fdc49,detect,medium,2027-04-09,Unpacked Statement loader,campaign:VulcanRAT207.A
sha256,cbf8ffe904a030c02b9def094f609b2c05a78fa5c7745d2d371d38dd460c58be,detect,medium,2027-04-09,Downloaded deployment bundle,campaign:VulcanRAT207.A
ipv4,61.18.208.27,detect,medium,2027-04-09,VulcanRAT207.A C2 (TCP 8888 HTTP then WebSocket),campaign:VulcanRAT207.A

Commodity tooling reused by this chain. Legitimately signed. Hunt with context (Q2, Q9); never import as block.

GoFly64.sys   Authenticode-signed third-party WFP network filter driver; aliases PandaSpeed64.sys, drv_02581.sys.
              Hunt by file name (Q9). The SHA-256 is on the LOLDrivers record (see References) and is not re-listed here.
vulkaninfo-64.exe (SHA-256) facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116
                            Intel-signed Khronos VulkanInfo 1.3.204.1; hash shared with a separate package this pack does not cover

VulcanRAT207.A - behavioral signatures (survive hash and IP rotation)

B1  vulkaninfo-64.exe present or executing under C:\Program Files\Common Files\
B2  vulkan-1.dll or vulkan-1.bin beside it (vulkan-1.bin is a non-PE encrypted sidecar)
B3  Scheduled task USOPrivate Kit or USOPrivate under \Microsoft\Windows or \Microsoft\Windows\AppID, running as SYSTEM
B4  PE staged as %WINDIR%\System32\drivers\tp_<digits>.tmp
B5  Kernel service tp_<digits> with system start type
B6  vulkaninfo-64.exe making network connections or parenting a shell
B7  Mutex Global\Admindllhost!!! (deployment DLL) or a mutex starting analplug (RAT)
B8  Named pipe <PID>_pipe (255 instances, 64 KiB) owned by the process whose PID it names
B9  Security-product process (Baidu bdservicehost.exe, bduserhost.exe) vanishing while a tp_ driver loads
B10 WFP session names NetstatBlockSession or BlockAllTrafficSession; filter names BlockAddr_Out, BlockAddr_In
B11 Window class PrivacyScreenClass (RAT remote-desktop privacy screen)

Names exactly as the sources use them

VulcanRAT207.A    WebSocket RAT (Morphisec); 207 is also visible in the 0x02072024 framework magic
GoFly64.sys       signed vulnerable driver; device \\.\GoFly; IOCTL 0x12227A (LOLDrivers, Morphisec)
Statement.exe     financial-document lure; wrapper Tax-202609078869.exe
Vulkan DLL side-load   vulkaninfo-64.exe + vulkan-1.dll + vulkan-1.bin
PoolParty Variant 7    injection technique into the Task Scheduler host

C2 protocol: HTTP registration then WebSocket v13 over TCP 8888; registration id 0x00013009, framework magic 0x02072024

# Read-only audit helpers (run per endpoint or through RTR / your RMM)

# A. Vulkan trio and its hashes
Get-ChildItem 'C:\Program Files\Common Files' -Include vulkaninfo-64.exe,vulkan-1.dll,vulkan-1.bin -Recurse -Force -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256 | Select-Object Path, Hash

# B. Task and service footprints
Get-ScheduledTask | Where-Object { $_.TaskName -like '*USOPrivate*' } | Select-Object TaskPath, TaskName
Get-CimInstance Win32_SystemDriver | Where-Object { $_.Name -like 'tp_*' } | Select-Object Name, State, PathName

# C. ASR vulnerable-driver rule state
(Get-MpPreference).AttackSurfaceReductionRules_Ids -contains '56a863a9-875e-4185-98a7-b882c64b5ce5'

Action policy: nothing is set to prevent. Campaign values are single-sourced (two-source rule), the hashes change on every rebuild (the deployment DLL appends randomized overlay data), and the commodity items are stock signed binaries. Promote a campaign value to prevent only after a second independent vendor lists it.

Work these in order. A query that has not cleared gate 2 has no business being an alert.

Controls are mapped to the technique, then to a MITRE mitigation (the why) and a vendor authority (the what and where). The chain's decisive step is loading a signed vulnerable driver, so the first tier is about stopping the driver from landing and loading.

Test every playbook on a pilot ring first. P1, P2 and P4 are audit-first by design. Each playbook lists its prerequisites, reboot requirement and rollback.

P1 · ASR vulnerable signed driver rule, audit (I1)

# P1 - ASR: Block abuse of exploited vulnerable signed drivers (AUDIT first)
# Prerequisites: Microsoft Defender Antivirus active; local administrator
# Reboot required: no
# Rollback: Remove-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5
#           (or Add-MpPreference with -AttackSurfaceReductionRules_Actions Disabled)

$id = '56a863a9-875e-4185-98a7-b882c64b5ce5'
Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions AuditMode

# Verify
$p = Get-MpPreference
$i = [array]::IndexOf($p.AttackSurfaceReductionRules_Ids, $id)
if ($i -ge 0) { "Rule present, action = " + $p.AttackSurfaceReductionRules_Actions[$i] }   # 2 = Audit, 1 = Block

# Review audit hits (Defender advanced hunting action type AsrVulnerableSignedDriverAudited) for 2 to 4 weeks, then move a pilot ring to Enabled.

P2 · Microsoft vulnerable driver blocklist as an App Control policy, audit (I2)

# P2 - Apply the Microsoft recommended vulnerable driver blocklist in AUDIT mode
# Prerequisites: local administrator; the audit-only SiPolicy.p7b and the App Control policy refresh tool,
#                downloaded from the Microsoft pages cited in the Microsoft Learn driver block rules article.
#                Skip if Windows 11 2022+ already enforces the default blocklist and you do not need the newest list.
# Reboot required: only if a driver the policy would block is already running (Microsoft Learn)
# Rollback: Remove-Item "$env:windir\System32\CodeIntegrity\SiPolicy.p7b"; run the refresh tool again; reboot

Copy-Item .\SiPolicy.p7b "$env:windir\System32\CodeIntegrity\SiPolicy.p7b" -Force
# Run the downloaded App Control policy refresh tool now to activate the policy.

# Verify: CodeIntegrity Operational log, Event ID 3099, PolicyName/PolicyId matches the blocklist XML
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-CodeIntegrity/Operational'; Id=3099} -MaxEvents 5 |
  Select-Object TimeCreated, Message

P3 · Task and service audit (I3)

# P3 - Audit scheduled task creation and enlarge the Task Scheduler operational log
# Prerequisites: local administrator; size the log first
# Reboot required: no
# Rollback: auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
#           wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:false

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable
wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true /ms:67108864

# Verify
auditpol /get /subcategory:"Other Object Access Events"
wevtutil gl Microsoft-Windows-TaskScheduler/Operational | Select-String 'enabled|maxSize'
# Service installs already log System Event 7045 by default; forward 4698 and 7045 to your SIEM.

P4 · ASR prevalence rule, audit (N1)

# P4 - ASR: block executables that fail prevalence, age or trusted-list checks (AUDIT first)
# Prerequisites: Microsoft Defender Antivirus active; cloud-delivered protection enabled; local administrator
# Reboot required: no
# Rollback: Remove-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25

$id = '01443614-cd74-433a-b99e-2ecdc07bfc25'
Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions AuditMode

# Verify
$p = Get-MpPreference
$i = [array]::IndexOf($p.AttackSurfaceReductionRules_Ids, $id)
if ($i -ge 0) { "Rule present, action = " + $p.AttackSurfaceReductionRules_Actions[$i] }

P5 · Evidence collection for a confirmed host

# P5 - Containment evidence collection (read-only; run BEFORE any cleanup)
# Prerequisites: local administrator or Falcon RTR with the needed role; host already network-contained
# Reboot required: no. Do NOT reboot: the RAT lives in memory.
# Rollback: none required (read-only). Cleanup is in the section 14 runbook.

$out = "$env:SystemDrive\IR-vulcan"; New-Item -ItemType Directory -Path $out -Force | Out-Null
Get-ChildItem 'C:\Program Files\Common Files' -Include vulkaninfo-64.exe,vulkan-1.dll,vulkan-1.bin -Recurse -Force -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256 | Export-Csv "$out\vulkan-trio-hashes.csv" -NoTypeInformation
Get-ChildItem "$env:WINDIR\System32\drivers" -Filter 'tp_*.tmp' -Force -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256 | Export-Csv "$out\tp-driver-hashes.csv" -NoTypeInformation
Get-CimInstance Win32_SystemDriver | Where-Object { $_.Name -like 'tp_*' } | Export-Csv "$out\tp-services.csv" -NoTypeInformation
Get-ScheduledTask | Where-Object { $_.TaskName -like '*USOPrivate*' } | Export-ScheduledTask | Out-File "$out\usoprivate-task.xml"
Get-NetTCPConnection -State Established | Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess | Export-Csv "$out\netstat.csv" -NoTypeInformation
Get-Process | Select-Object Id, ProcessName, Path | Export-Csv "$out\processes.csv" -NoTypeInformation

Sequencing rule: the chain is built to kill security software and runs as SYSTEM. Treat the host as fully compromised, assume the endpoint sensor may be dead or lying, and confirm host state with out-of-band tools. The RAT has keylogging, clipboard replacement and local account creation, so treat every credential typed on the host as exposed.

Validation gates (summary): telemetry ready (G1), benign baseline (G2), positive test (G3), negative test (G4), Monitor-mode promotion (G5), response readiness (G6). Full table in section 11.

Honest scope: this pack detects the on-disk footprints (Vulkan trio, staged driver, service, task), the process relationships of the side-load host, and the C2 consequences. It cannot see the injection into Task Scheduler, the in-memory RAT, the driver IOCTL, the killed security processes or the WFP filters. If the first hit is a Q10 or Q11 network detection, assume the earlier stages already ran and the sensor may have been tampered with.