{"id":2564,"date":"2026-08-27T11:32:15","date_gmt":"2026-08-27T11:32:15","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2564"},"modified":"2026-08-27T11:32:15","modified_gmt":"2026-08-27T11:32:15","slug":"spark-rat-targets-cambodia-abuses-vulnerable-opswat-driver-to-disable-security-tools","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2564","title":{"rendered":"Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools"},"content":{"rendered":"
\n
<\/a><\/div>\n

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT<\/strong>.<\/p>\n

\u00abThe samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics,\u00bb Acronis Threat Research Unit (TRU) researchers Darrel Virtusio and Subhajeet Singha said<\/a> in an analysis published Wednesday.<\/p>\n

The multi-stage attack is notable for employing the bring your own vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover (\u00abardrv.sys\u00bb) to escalate privileges and neutralize security software.<\/p>\n

Attack chains likely make use of targeting phishing emails to distribute compressed archives containing an Inno Setup executable and trick recipients into running it using wide-ranging lures, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers.<\/p>\n

Acronis said it discovered a number of malicious artifacts between late June through early August 2026, although it’s unclear if the campaign remains ongoing.<\/p>\n

The Inno Setup installer is designed to trigger a DLL side-loading chain using a signed Tencent executable, which then delivers interim payloads responsible for deploying the vulnerable \u00abardrv.sys\u00bb and then launching the Spark RAT payload. Spark RAT is an open-source, Go-based cross-platform RAT<\/a> that enables remote control of compromised devices.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The DLL loader also carries out a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and proceeds to terminate execution if the elapsed time falls outside the expected range. Furthermore, it reviews running processes for those related to Huorong Internet Security (\u00abHipsTray.exe\u00bb), a Chinese endpoint security program.<\/p>\n

<\/p>\n

If the process is present, the loader attempts to weaken the privileges of the security product. In the next stage, it decrypts shellcode concealed within a PNG file present in the archive to run a second stager, which verifies if it is running with SYSTEM privileges.<\/p>\n

\u00abBased on these checks, the payload selects one of two execution modes,\u00bb Acronis said. \u00abIf it is already running as SYSTEM, it proceeds directly to inject mode, bypassing the persistence setup and executing the next stage. Otherwise, it enters setup mode, where it establishes persistence first, then executes the next stage.\u00bb<\/p>\n

The inject mode works by parsing and decrypting shellcode embedded in another PNG file from the archive, and then injecting it into \u00abvssvc.exe\u00bb and executing it within the context of the target process. To ensure the injected payload remains running, it monitors the \u00abvssvc.exe\u00bb instance and re-injects the shellcode if the process terminates or restarts with a new PID.<\/p>\n

In the setup mode, the malware reads and decrypts the shellcode from the same file, after which it checks for a list of hard-coded processes associated with Qihoo 360. If none of them are found, it sets up a Windows service-based persistence mechanism to launch the binary that sideloads the DLL to relaunch the entire cycle all over again. After establishing persistence on the host, it injects the shellcode into \u00abvssvc.exe\u00bb like before.<\/p>\n

The payload performs the following sequence of actions –<\/p>\n