Spark RAT Campaign Targets Cambodia Using Vulnerable OPSWAT Driver to Disable Security Tools

Cybersecurity researchers at Acronis Threat Research Unit (TRU) have uncovered a new campaign targeting individuals and organizations in Cambodia with an open-source remote access trojan (RAT) called Spark RAT. The attackers employ diverse lure themes, including government notices, public health materials, real estate content, and promotional offers, to trick victims into running malicious attachments delivered via phishing emails.

The multi-stage attack chain leverages the bring your own vulnerable driver (BYOVD) technique to load a legitimate but vulnerable driver associated with OPSWAT AppRemover (ardrv.sys), tracked as CVE-2026-36425, to escalate privileges and disable security software. The infection begins with an Inno Setup executable that triggers a DLL side-loading chain using a signed Tencent executable. This delivers interim payloads that deploy the vulnerable driver and launch the Spark RAT payload.

Spark RAT is an open-source, Go-based cross-platform RAT that enables remote control of compromised devices. The DLL loader includes a timing-based anti-sandbox check and reviews running processes for Huorong Internet Security (HipsTray.exe). If present, it attempts to weaken the security product’s privileges. The payload then decrypts shellcode concealed within PNG files to execute a second stager, which verifies SYSTEM privileges and selects between two execution modes: inject mode or setup mode.

In inject mode, the malware injects shellcode into vssvc.exe and monitors the process to re-inject if it terminates. In setup mode, it establishes persistence via a Windows service and then injects into vssvc.exe. The final payload patches AMSI and ETW, installs the vulnerable driver to terminate security processes (including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager), and executes Spark RAT via injection into ctfmon.exe.

Acronis noted similarities to the Silver Fox threat actor, including the use of TrueSight and Zemana Anti-Malware SDK drivers, DLL sideloading, and targeting of Huorong processes. However, the absence of shared infrastructure, code reuse, and matching certificates prevents definitive attribution. The Spark RAT configuration contains Chinese-language values, suggesting possible Chinese-language development or deployment links. Acronis tracks the activity as an unattributed cluster with low confidence, which may change with additional evidence.