Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Summary

A new campaign is targeting Cambodia with Spark RAT, an open-source remote access trojan. The attack utilizes a Bring Your Own Vulnerable Driver (BYOVD) technique, abusing a legitimate but vulnerable OPSWAT driver to escalate privileges and disable security software. The campaign employs diverse lure themes and a multi-stage attack chain involving Inno Setup installers and signed Tencent executables.

Full text

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools Ravie LakshmananAug 27, 2026Malware / Vulnerability Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics," Acronis Threat Research Unit (TRU) researchers Darrel Virtusio and Subhajeet Singha said in an analysis published Wednesday. The multi-stage attack is notable for employing the bring your own vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover ("ardrv.sys") to escalate privileges and neutralize security software. Attack chains likely make use of targeting phishing emails to distribute compressed archives containing an Inno Setup executable and trick recipients into running it using wide-ranging lures, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. Acronis said it discovered a number of malicious artifacts between late June through early August 2026, although it's unclear if the campaign remains ongoing. The Inno Setup installer is designed to trigger a DLL side-loading chain using a signed Tencent executable, which then delivers interim payloads responsible for deploying the vulnerable "ardrv.sys" and then launching the Spark RAT payload. Spark RAT is an open-source, Go-based cross-platform RAT that enables remote control of compromised devices. The DLL loader also carries out a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and proceeds to terminate execution if the elapsed time falls outside the expected range. Furthermore, it reviews running processes for those related to Huorong Internet Security ("HipsTray.exe"), a Chinese endpoint security program. If the process is present, the loader attempts to weaken the privileges of the security product. In the next stage, it decrypts shellcode concealed within a PNG file present in the archive to run a second stager, which verifies if it is running with SYSTEM privileges. "Based on these checks, the payload selects one of two execution modes," Acronis said. "If it is already running as SYSTEM, it proceeds directly to inject mode, bypassing the persistence setup and executing the next stage. Otherwise, it enters setup mode, where it establishes persistence first, then executes the next stage." The inject mode works by parsing and decrypting shellcode embedded in another PNG file from the archive, and then injecting it into "vssvc.exe" and executing it within the context of the target process. To ensure the injected payload remains running, it monitors the "vssvc.exe" instance and re-injects the shellcode if the process terminates or restarts with a new PID. In the setup mode, the malware reads and decrypts the shellcode from the same file, after which it checks for a list of hard-coded processes associated with Qihoo 360. If none of them are found, it sets up a Windows service-based persistence mechanism to launch the binary that sideloads the DLL to relaunch the entire cycle all over again. After establishing persistence on the host, it injects the shellcode into "vssvc.exe" like before. The payload performs the following sequence of actions - Attempt to patch AMSI and ETW related functionality Setup persistence using a scheduled task Install the ardrv.sys driver that's vulnerable to CVE-2026-36425 to terminate security-related processes such as Microsoft Defender, Huorong Internet Security, and Tencent PC Manager Read and decrypt another embedded payload from a third PNG file to perform user-mode termination of hard-coded security processes Simultaneously, a fourth PNG-based payload file is processed to extract and decrypt shellcode that's injected into "ctfmon.exe," ultimately leading to the execution of Spark RAT. Interestingly, the BYOVD routine references a number of other drivers, including those part of TrueSight and Zemana Anti-Malware SDK, both of which have been put to use by the Silver Fox threat actor prior to dropping Winos 4.0 (aka ValleyRAT). In addition, the targeting of Huorong security processes has been repeatedly observed in past Silver Fox-related attacks. Other Silver Fox-style indicators include targeting overlaps, the use of DLL sideloading through a signed application, multi-stage payload delivery, persistence through Windows services and scheduled tasks, and Microsoft Defender exclusions. Despite these similarities, there is not enough evidence to definitively attribute the latest activity to the threat actor. This assessment, Acronis said, is based on the absence of shared infrastructure, function-level code reuse, and matching certificates. Another crucial differentiator is the choice of the malware itself. While Silver Fox campaigns are known to leverage ValleyRAT and other custom payloads, it has not been attributed to the deployment of an open-source RAT. "This difference does not rule out a relationship, since operators can change payloads, but it removes one of the stronger links used in previous attributions," the cybersecurity company added. "The Spark RAT configuration contains a Chinese-language value, and the malware targets several security products commonly used in Chinese-speaking environments." "We therefore track the activity as an unattributed cluster with possible Chinese-language development or deployment links and operational similarities to the broader Silver Fox ecosystem. This assessment remains low confidence and may change if additional code, infrastructure, victimology, or other attributional evidence is identified." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cyber espionage, Malware, Phishing, Vulnerability ⚡ Top Stories This Week Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE Attackers Exploit SharePoint Authentication Bypass After Public Po

Indicators of Compromise

• cve — CVE-2026-36425

Entities