Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.
Acronis TRU analyzed a multi-stage Spark RAT campaign targeting Cambodian individuals and organizations with lures spanning government notices, public health materials, and real estate documents. Attack chains use phishing emails with Inno Setup archives, DLL side-loading via a signed Tencent executable, and BYOVD abuse of the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to terminate security software. Shellcode hidden in PNG files patches AMSI and ETW, establishes scheduled task and service persistence, and injects into vssvc.exe and ctfmon.exe to run the open-source Go-based Spark RAT. Tactics resemble the Silver Fox actor, but Acronis tracks the cluster as unattributed with low confidence.
- Go-based open-source Spark RAT gives attackers remote control of compromised devices
- BYOVD loads ardrv.sys (CVE-2026-36425) to terminate Defender, Huorong, and Tencent PC Manager
- Timing-based anti-sandbox checks detect manipulated sleep delays before execution
- Lures include Cambodian government notices, health announcements, dental records, and real estate documents
- CVEs
- CVE-2026-36425
- ATT&CK
- T1566.001 Spearphishing AttachmentT1574.002 DLL Side-LoadingT1053.005 Scheduled TaskT1562.001 Impair Defenses: Disable or Modify ToolsT1543.003 Windows Service
- Products
- OPSWAT AppRemover
- Threat actors
- Silver Fox
- Malware
- Spark RAT
- Organizations
- Acronis Threat Research UnitOPSWAT
- Countries
- Cambodia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-36425 | An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031 | 6.5 | <1% |
From the original article
4 min read at thehackernews.com
Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT . "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.