VulcanRAT207.A + Kimsuky 'GitPower': OTX Pulse Analysis — WhatsApp-Delivered RAT Chains & Nation-State Espionage Detection Pack

---
title: VulcanRAT207.A PoolParty Injection into Task Scheduler Process
id: 8f3a1c2e-7b44-4d9a-a1c5-vulc207inj001
status: experimental
description: Detects suspicious thread injection or anomalous module loads targeting svchost/Task Scheduler consistent with PoolParty Variant 7 injection used by VulcanRAT207.A
author: Security Arsenal Threat Intel
date: 2026/10/13
references:
    - https://www.morphisec.com/blog/vulcanrat207-a_intrusion-chain_explained
logsource:
    category: process_creation
    product: windows
detection:
    selection_scheduler:
        Image|endswith: '\svchost.exe'
        CommandLine|contains: 'Schedule'
    selection_suspicious_child:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
    condition: selection_scheduler and selection_suspicious_child
falsepositives:
    - Legitimate scheduled tasks invoking scripts (tune with CommandLine allowlist)
level: high
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1055
---
title: VulcanRAT207.A GoFly64 Kernel Driver Load
id: 8f3a1c2e-7b44-4d9a-a1c5-vulc207drv002
status: experimental
description: Detects load of the GoFly64.sys malicious driver associated with VulcanRAT207.A persistence
author: Security Arsenal Threat Intel
date: 2026/10/13
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: 'GoFly64.sys'
    condition: selection
falsepositives:
    - None expected
level: critical
tags:
    - attack.persistence
    - attack.t1068
    - attack.t1547.006
---
title: Kimsuky GitPower - LNK or CHM Spawning PowerShell
id: 8f3a1c2e-7b44-4d9a-a1c5-kimsukygp003
status: experimental
description: Detects PowerShell spawned from LNK or CHM execution, consistent with Kimsuky Operation GitPower spear-phishing delivery targeting Ukrainian government experts
author: Security Arsenal Threat Intel
date: 2026/10/13
references:
    - https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower
logsource:
    category: process_creation
    product: windows
detection:
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\hh.exe'
        ParentCommandLine|contains:
            - '.lnk'
            - '.chm'
    selection_encoded:
        CommandLine|contains:
            - ' -enc'
            - ' -ec'
            - 'FromBase64String'
            - 'DownloadString'
    condition: selection_child and selection_parent and selection_encoded
falsepositives:
    - Rare; legitimate CHM help files do not spawn encoded PowerShell
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002

// Kimsuky GitPower + VulcanRAT207.A unified hunt — Microsoft Sentinel
let kimsuky_hosts = dynamic(["pokijhgcfsdfghnj.mywebcommunity.org","minecrafter.mygamesonline.org","bwer5t6kl.getenjoyment.net","cmieqf7yjs.sportsontheweb.net","p1o2i3u4y5t6r7e8w9q0.medianewsonline.com"]);
let kimsuky_ip = "111.92.246.145";
let vulcan_hashes = dynamic(["facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116","2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a","0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb","be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where Timestamp > ago(14d)
    | where RemoteUrl in~ (kimsuky_hosts) or RemoteIP == kimsuky_ip
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, Hunt="Kimsuky-C2"),
    (DeviceProcessEvents
    | where Timestamp > ago(14d)
    | where SHA256 in~ (vulcan_hashes)
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine, Hunt="VulcanRAT-Hash"),
    (DeviceProcessEvents
    | where Timestamp > ago(14d)
    | where FileName =~ "svchost.exe" and ProcessCommandLine has "Schedule"
    | join kind=inner (DeviceProcessEvents
        | where Timestamp > ago(14d)
        | where FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","mshta.exe","regsvr32.exe"))
        on DeviceName
    | project Timestamp, DeviceName, FileName1, ProcessCommandLine1, Hunt="PoolParty-Scheduler-Injection")
| sort by Timestamp desc

# VulcanRAT207.A + Kimsuky GitPower — Host IOC Hunt Script
# Run elevated on suspect endpoints. Outputs findings to console + CSV.

$findings = @()

# --- 1. VulcanRAT207.A: Hunt for GoFly64.sys driver ---
$driverPaths = @("$env:SystemRoot\System32\drivers\GoFly64.sys", "$env:SystemRoot\SysWOW64\drivers\GoFly64.sys")
foreach ($p in $driverPaths) {
    if (Test-Path $p) {
        $findings += [PSCustomObject]@{Type="Driver"; Artifact=$p; Verdict="MALICIOUS - VulcanRAT207.A persistence driver"}
    }
}
Get-CimInstance Win32_SystemDriver | Where-Object { $_.Name -like "*gofly*" -or $_.PathName -like "*gofly64*" } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="LoadedDriver"; Artifact=$_.PathName; Verdict="SUSPICIOUS - loaded GoFly driver service"}
}

# --- 2. VulcanRAT207.A: Statement.exe lure artifacts ---
$lurePaths = @("$env:TEMP\Statement.exe", "$env:USERPROFILE\Downloads\Statement.exe", "$env:USERPROFILE\Desktop\Statement.exe")
foreach ($p in $lurePaths) {
    if (Test-Path $p) {
        $h = (Get-FileHash $p -Algorithm SHA256).Hash
        $findings += [PSCustomObject]@{Type="File"; Artifact="$p (SHA256: $h)"; Verdict="SUSPICIOUS - WhatsApp lure filename"}
    }
}

# --- 3. Known malicious hashes sweep in common staging dirs ---
$badHashes = @("facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116","2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a","0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb","be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9","297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cad","d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a")
foreach ($dir in @($env:TEMP, "$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:LOCALAPPDATA\Temp")) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h) {
            $findings += [PSCustomObject]@{Type="FileHash"; Artifact=$_.FullName; Verdict="MALICIOUS - OTX pulse hash match"}
        }
    }
}

# --- 4. Kimsuky GitPower: Network connections to C2 ---
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq "111.92.246.145" } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $findings += [PSCustomObject]@{Type="Network"; Artifact="$($_.RemoteAddress):$($_.RemotePort) via $proc"; Verdict="MALICIOUS - Kimsuky C2 connection"}
}

# --- 5. Kimsuky GitPower: DNS cache check for dynamic-DNS C2 ---
$kimsukyHosts = @("mywebcommunity.org","mygamesonline.org","getenjoyment.net","sportsontheweb.net","medianewsonline.com")
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $n=$_.Entry; ($kimsukyHosts | Where-Object { $n -like "*$_*" }) } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="DNS"; Artifact=$_.Entry; Verdict="SUSPICIOUS - Kimsuky dynamic-DNS resolution"}
}

# --- 6. Persistence: anomalous scheduled tasks (PoolParty target process) ---
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match "powershell|cmd|rundll32|mshta" } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="ScheduledTask"; Artifact=$_.TaskName; Verdict="REVIEW - script-interpreter task (potential persistence)"}
}

if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv ".\OTX_Hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) finding(s). Isolate host and escalate to IR." -ForegroundColor Red
} else {
    Write-Host "[+] No OTX pulse indicators found on this host." -ForegroundColor Green
}