Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

This campaign demonstrates the growing abuse of the Bring Your Own Vulnerable Driver (BYOVD) technique, where attackers deliberately introduce a legitimate but unpatched driver to gain kernel-level privileges and disable endpoint security software. The root failure lies in organizations not maintaining inventories of approved drivers and not blocking known-vulnerable drivers from loading. By weaponizing a signed, trusted driver, attackers effectively bypass conventional security controls that would otherwise flag malicious binaries. This matters because once security tools are disabled at the kernel level, the attacker operates with near-impunity, making detection and response extremely difficult. The use of legitimate signed executables (Tencent) further illustrates how trust in signed software can be exploited when proper allow-listing policies are absent.