CyberXero IAB Operations, VulcanRAT207.A WhatsApp Intrusion Chain & GhostFrame ESXi Implant: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Threat Summary

Three concurrent OTX pulses published 2026-11-11 reveal a threat landscape where initial access, privilege escalation, and virtualization-layer persistence are converging into full-stack enterprise compromise.

CyberXero, a Russian-speaking financially motivated Initial Access Broker (IAB), is running two parallel operations: (1) a global mass-exploitation campaign against WordPress, Magento, and e-commerce platforms using wp2shell and WSO webshells, and (2) a directed campaign against Ukrainian energy, utilities, government, and telecommunications organizations. Notably, the actor is AI-augmented, deploying specialized Claude-based tooling (PentAGI) to accelerate exploitation and post-exploitation workflows — an evolution security teams should treat as a signpost for adversary tradecraft in 2026. Accesses brokered by CyberXero are monetized on dark web forums, meaning the exploitation artifacts you see today may become ransomware or espionage intrusions tomorrow.

TA4922 is operating a sophisticated intrusion chain beginning with WhatsApp-delivered financial document lures carrying Statement.exe. The payload uses NRV2E compression for concealment, performs host screening, elevates privileges via COM-based techniques, and achieves SYSTEM via PoolParty Variant 7 process injection into the Windows Task Scheduler process — landing the VulcanRAT207.A WebSocket-based RAT with the kernel driver GoFly64.sys for persistence.

TAG-218 has deployed GhostFrame, a previously undocumented post-exploitation framework targeting VMware ESXi hypervisors, linked to Settra ransomware operations against U.S. organizations. GhostFrame operates from the virtualization layer: harvesting credentials via VMkatz, executing commands, accessing guest VMs, and pivoting — all below the visibility of in-guest EDR. MeshCentral is abused as the remote access tool of choice.

The collective signal: adversaries are moving both down the stack (hypervisor implants, kernel drivers) and around traditional delivery (messaging-app lures, CMS mass exploitation). Perimeter and endpoint-only visibility is no longer sufficient.

Threat Actor / Malware Profiles

CyberXero (Initial Access Broker)

Distribution: Mass exploitation of WordPress/Magento/e-commerce CMS platforms (CVE-2015-1397, CVE-2026-4815, CVE-2026-60137, CVE-2026-63030); directed phishing/webshell operations against Ukrainian critical infrastructure.
Payload behavior: Drops wp2shell and WSO webshell variants on compromised web servers; deploys Cobalt Strike (S0154) beacons for hands-on access; stages access for resale on dark web forums.
C2 communication: Cobalt Strike beaconing over HTTP/S; webshell control via obfuscated HTTP POST requests.
Persistence: Webshells in webroot directories; scheduled cron jobs on Linux web servers; rogue admin accounts in CMS backends.
Anti-analysis: AI-augmented tooling (PentAGI) for rapid exploit customization; webshell obfuscation and password-gated execution.

VulcanRAT207.A (TA4922)

Distribution: WhatsApp-delivered financial document lures (Statement.exe).
Payload behavior: NRV2E-packed loader; extensive host screening (sandbox/VM checks); COM-based privilege elevation; PoolParty Variant 7 injection into the Windows Task Scheduler process (svchost.exe hosting the Schedule service).
C2 communication: WebSocket-based RAT channel (VulcanRAT207.A) — expect long-lived ws:// or wss:// sessions to non-standard ports.
Persistence: Kernel driver GoFly64.sys (BYOVD-style capability); Task Scheduler abuse; injected threads inside trusted system processes.
Anti-analysis: NRV2E compression, host screening, injection into signed system binaries to evade parent-child heuristics.

GhostFrame / TAG-218 (Settra Ransomware Ecosystem)

Distribution: Post-exploitation deployment after root-level ESXi access, exploiting CVE-2026-0257 and targeting VPN appliances for initial foothold.
Payload behavior: Unified interface over compromised ESXi hosts — VM access, command execution, lateral pivoting; VMkatz for credential harvesting from guest memory; ransomware staging against entire datastores.
C2 communication: MeshCentral agent for remote access; tunneling over legitimate RMM infrastructure to blend with admin traffic.
Persistence: ESXi-level persistence surviving guest OS reinstalls and in-guest EDR; rogue services/vib packages on the hypervisor.
Anti-analysis: Operates below the OS layer — invisible to in-guest security tooling; leverages legitimate RMM software to evade network-based detection.

IOC Analysis

The indicator set spans four types, each requiring different operational handling:

CVEs (CVE-2015-1397, CVE-2026-4815, CVE-2026-60137, CVE-2026-63030, CVE-2026-0257): Feed directly into vulnerability management prioritization. Cross-reference against your CMS estate (WordPress/Magento plugins) and ESXi/VPN appliance inventory. Treat CVE-2026-0257 on internet-facing ESXi management interfaces as emergency-patch.
IPv4 (212.193.31.189): CyberXero-associated infrastructure. Block at egress proxy/firewall; retro-hunt NetFlow and DNS logs for 90 days. Low false-positive risk on block.
File hashes (MD5/SHA1/SHA256): Eight SHA256 values across the three pulses cover Statement.exe/VulcanRAT207.A stages, webshell payloads, and GhostFrame components. Push SHA256 values to EDR blocklists and threat intel platforms (MISP, Sentinel TI). Use SHA1/MD5 only for historical log correlation — collision attacks make them unsuitable as sole block criteria.
Tooling for decode/pivot: OTX pulses pivot into SOCRadar (CyberXero), Morphisec (VulcanRAT207.A), and Recorded Future (GhostFrame) reporting. Use otxv2 Python SDK or MISP feed synchronization for automated ingestion; hash lookups via VirusTotal Enterprise or Hybrid Analysis for sandbox detonation context.

Detection Engineering

YAML

---
title: VulcanRAT207.A Statement.exe Execution via WhatsApp Lure
id: 8f3a1b2c-207a-4e11-9c01-vulcanrat207a01
status: experimental
description: Detects execution of Statement.exe or VulcanRAT207.A stage-1 loaders delivered via WhatsApp desktop cache or download directories, consistent with TA4922 intrusion chain.
author: Security Arsenal Threat Intelligence
references:
  - https://www.morphisec.com/blog/vulcanrat207-a_intrusion-chain_explained
date: 2026/11/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_filename:
    Image|endswith: '\statement.exe'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\WhatsApp\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\WhatsApp\'
  selection_hash:
    Hashes|contains:
      - 'SHA256=facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116'
      - 'SHA256=2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a'
      - 'SHA256=0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb'
      - 'SHA256=be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9'
  condition: selection_filename and selection_path or selection_hash
falsepositives:
  - Legitimate financial documents named Statement.exe (rare — validate signer)
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
---
title: PoolParty Injection into Task Scheduler Service via svchost
id: 9a4b2c3d-307b-4f22-8d02-poolpartyinj01
status: experimental
description: Detects suspicious module loads or thread creation in svchost.exe instances hosting the Task Scheduler (Schedule) service, consistent with PoolParty Variant 7 injection used by VulcanRAT207.A. Also detects GoFly64.sys driver load.
author: Security Arsenal Threat Intelligence
date: 2026/11/11
logsource:
  category: image_load
  product: windows
detection:
  selection_inject:
    Image|endswith: '\svchost.exe'
    CommandLine|contains: 'Schedule'
    ImageLoaded|endswith:
      - '.tmp'
      - '.dat'
  selection_driver:
    ImageLoaded|endswith: '\gofly64.sys'
  condition: 1 of selection_*
falsepositives:
  - Rare; unsigned modules loading into Schedule-hosted svchost warrant investigation
level: critical
tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055
  - attack.t1068
---
title: WSO / wp2shell Webshell Drop in CMS Webroot
id: 7c5d3e4f-408c-4a33-9e03-cyberxeroweb01
status: experimental
description: Detects creation of PHP webshell files in WordPress/Magento webroot directories consistent with CyberXero wp2shell and WSO webshell deployment.
author: Security Arsenal Threat Intelligence
references:
  - https://socradar.io/blog/dark-web-profile-cyberxero/
date: 2026/11/11
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-includes/'
      - '/var/www/html/'
      - '/pub/media/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  filter_known_deploy:
    SourceImage|endswith:
      - '/usr/bin/composer'
      - '/usr/bin/git'
  condition: selection_path and selection_ext and not filter_known_deploy
falsepositives:
  - CMS plugin updates — correlate with deployment windows and change tickets
level: high
tags:
  - attack.persistence
  - attack.t1505.003

KQL — Microsoft Sentinel / Defender

// Hunt: VulcanRAT207.A, CyberXero C2, and GhostFrame/VMkatz artifacts across the estate
let Sha256IOCs = dynamic([
  "facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116",
  "2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a",
  "0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb",
  "be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9",
  "92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090",
  "a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c",
  "71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192",
  "a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10"
]);
let HashHits = DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in~ (Sha256IOCs)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName;
let NetHits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP == "212.193.31.189"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl;
let BehaviorHits = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "statement.exe"
   or ProcessCommandLine has_any ("gofly64", "meshagent", "vmkatz")
   or (FileName =~ "svchost.exe" and ProcessCommandLine has "Schedule" and InitiatingProcessFileName !in~ ("services.exe", "svchost.exe", "MsMpEng.exe"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union HashHits, NetHits, BehaviorHits
| sort by Timestamp desc

PowerShell

# Security Arsenal - OTX Pulse IOC Hunt: CyberXero / VulcanRAT207.A / GhostFrame
# Run elevated on Windows endpoints. Outputs findings to console + CSV.

$report = @()

$hashes = @(
  "FACF78D474B66ED821288DB41FA6AD8A7B6F30650EB12127CB3E9A3CC6146116",
  "2FDFDD13A0C548BB68C9D5AA8599A9265D4659DA3E237FE7A42AC6AC06B9A06A",
  "0C418989BBC836208A087DEE8FD64210F58909DDDF736BC94769C269F65C26EB",
  "BE740B05CAEAD2FA4521F42DA0653A10F53029DF5455EBAFE4701AB3D41AFDF9"
)

# 1) Hash sweep of high-risk staging directories
$paths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\ProgramData", "$env:APPDATA\WhatsApp")
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      try {
        $h = (Get-FileHash -Algorithm SHA256 -Path $_.FullName -ErrorAction Stop).Hash
        if ($hashes -contains $h) {
          $report += [pscustomobject]@{Type="HashMatch"; Detail="$($_.FullName) [$h]"; Severity="CRITICAL"}
        }
      } catch {}
    }
  }
}

# 2) GoFly64.sys driver presence
$drv = Get-ChildItem "C:\Windows\System32\drivers\gofly64.sys" -ErrorAction SilentlyContinue
if ($drv) { $report += [pscustomobject]@{Type="MaliciousDriver"; Detail=$drv.FullName; Severity="CRITICAL"} }

# 3) MeshCentral / rogue RMM services (GhostFrame tradecraft)
$svc = Get-Service | Where-Object { $_.Name -match "mesh|MeshCentral" }
foreach ($s in $svc) { $report += [pscustomobject]@{Type="RMMService"; Detail="$($s.Name) - $($s.Status)"; Severity="HIGH"} }

# 4) Suspicious scheduled tasks (VulcanRAT207.A persistence)
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match "statement\.exe|AppData|Temp" -and $_.TaskPath -notlike "\Microsoft\*"
} | ForEach-Object {
  $report += [pscustomobject]@{Type="SuspiciousTask"; Detail="$($_.TaskName) -> $($_.Actions.Execute)"; Severity="HIGH"}
}

# 5) Active/recent connections to CyberXero infrastructure
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq "212.193.31.189" } | ForEach-Object {
  $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
  $report += [pscustomobject]@{Type="C2Connection"; Detail="$($_.RemoteAddress):$($_.RemotePort) via $proc (PID $($_.OwningProcess))"; Severity="CRITICAL"}
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\otx_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
if (-not $report) { Write-Host "[+] No indicators matched on this host." -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours)

Block 212.193.31.189 at egress firewall/proxy; push all SHA256 indicators from these pulses to EDR block policy.
Hunt for Statement.exe execution, gofly64.sys, and anomalous module loads into Schedule-hosted svchost.exe using the detections above.
Sweep CMS webroots for recently created PHP files (wp2shell/WSO); take compromised web servers offline pending forensic imaging.
Audit ESXi hosts for unauthorized VIBs/services, unexpected MeshCentral agents, and vSphere logins from VPN appliance IPs.

24 Hours

Identity verification (mandatory): VMkatz and VulcanRAT207.A both enable credential theft. Force password resets for any user on a host with a detection hit; rotate vSphere/ESXi root and service account credentials; revoke active sessions and OAuth grants.
Retro-hunt 90 days of proxy/DNS/NetFlow for the IPv4 IOC and WhatsApp-file-transfer patterns in mail/chat gateways.
Validate MFA enforcement on VPN appliances — the GhostFrame intrusion vector.

1 Week

Architecture hardening: Remove ESXi management interfaces from any routable exposure; enforce lockdown mode and enable ESXi secure boot + execInstalledOnly. Patch CVE-2026-0257 and the CMS CVEs (CVE-2026-4815, CVE-2026-60137, CVE-2026-63030) across the estate.
Deploy hypervisor-layer telemetry (ESXi syslog forwarding, vCenter event auditing) into the SIEM — in-guest EDR cannot see GhostFrame-class implants.
Restrict WhatsApp Desktop file execution via AppLocker/WDAC policies for finance and administrative staff — the primary lure targets.
Establish a dark web monitoring watch on CyberXero access listings matching your sector and geography; brokered access is a pre-ransomware leading indicator.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

CyberXero IAB Operations, VulcanRAT207.A WhatsApp Intrusion Chain & GhostFrame ESXi Implant: OTX Pulse Analysis — Enterprise Detection Pack