Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
A new cyber campaign targets Cambodia using Spark RAT, an open-source Go-based remote access trojan, delivered via phishing emails with diverse lures including government notices, health materials, and real estate documents The attack employs a BYOVD (Bring Your Own Vulnerable Driver) technique using the OPSWAT AppRemover driver (ardrv.sys) vulnerable to CVE-2026-36425 to escalate privileges and neutralize security software The multi-stage payload uses DLL side-loading through a signed Tencent e
Analysis
TL;DR
- A new cyber campaign targets Cambodia using Spark RAT, an open-source Go-based remote access trojan, delivered via phishing emails with diverse lures including government notices, health materials, and real estate documents
- The attack employs a BYOVD (Bring Your Own Vulnerable Driver) technique using the OPSWAT AppRemover driver (ardrv.sys) vulnerable to CVE-2026-36425 to escalate privileges and neutralize security software
- The multi-stage payload uses DLL side-loading through a signed Tencent executable, anti-sandbox timing checks, shellcode hidden in PNG files, and injection into legitimate processes like vssvc.exe and ctfmon.exe
- The campaign shows operational similarities to the Silver Fox threat actor but lacks definitive attribution due to absence of shared infrastructure, code reuse, and matching certificates
- The threat is tracked as an unattributed cluster with possible Chinese-language development links, given the Chinese-language values in the Spark RAT configuration and targeting of security products common in Chinese-speaking environments
Why It Matters
This campaign demonstrates the growing trend of threat actors leveraging open-source malware tools combined with sophisticated evasion techniques, making detection increasingly challenging for security teams. The use of BYOVD attacks against legitimate drivers highlights a critical gap in endpoint protection strategies that rely solely on signature-based detection. For AI and cybersecurity practitioners, this case underscores the importance of monitoring for unusual driver loading behaviors and implementing behavioral analysis capabilities.
Technical Details
- Delivery Mechanism: Phishing emails with varied lure themes (government notices, public health materials, dental records, real estate documents) distribute compressed archives containing an Inno Setup executable that triggers a DLL side-loading chain using a signed Tencent executable
- BYOVD Exploitation: The malware deploys the vulnerable OPSWAT AppRemover driver (ardrv.sys) exploiting CVE-2026-36425 to gain SYSTEM privileges and terminate security processes including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager
- Evasion Techniques: Includes timing-based anti-sandbox checks that detect manipulated sleep delays, process monitoring for specific security products (Huorong's HipsTray.exe, Qihoo 360 processes), and shellcode concealed within PNG image files across multiple stages
- Persistence and Execution: Two execution modes based on privilege level—inject mode (if already running as SYSTEM) bypasses persistence and injects shellcode into vssvc.exe, while setup mode establishes Windows service-based persistence before injection; the payload also patches AMSI and ETW functionality and sets up scheduled task persistence
- Attribution Analysis: References to drivers previously used by Silver Fox (TrueSight, Zemana Anti-Malware SDK) and targeting of Huorong processes suggest possible connections, but Acronis maintains low-confidence attribution due to lack of shared infrastructure, code reuse, or matching certificates
Industry Insight
Security teams should prioritize monitoring for unauthorized driver loading activities and implement kernel-level attestation to detect BYOVD attacks, as traditional endpoint protection struggles to distinguish between legitimate and malicious driver operations. Organizations operating in Southeast Asian markets should enhance phishing awareness training with region-specific lure themes and implement email sandboxing to detect malicious archives before delivery. The shift toward open-source RATs like Spark RAT by threat actors indicates a democratization of advanced capabilities, suggesting defenders should focus on behavioral detection patterns rather than relying solely on known malware signatures.
Disclaimer: The above content is generated by AI and is for reference only.