Organizations and individuals in Cambodia have become the target of a new campaign centered on Spark RAT, an open-source remote access trojan (RAT). Researchers at Acronis describe how the attackers use multiple layers to get victims to start a malicious chain through deceptive content—with the most notable element being the BYOVD technique (Bring Your Own Vulnerable Driver) to increase privileges and undermine security software.
While parallels exist with earlier campaigns in a broader “Silver Fox”-like context, the exact attribution remains uncertain. What stands out most: the malware is designed to weaken targeted endpoint protection first, and only then activate the RAT capabilities.
Which lures are used to lure victims?
The campaign uses various themes to reach a wide group of potential victims. According to Acronis, the lures range from topics related to government information and public health to real estate content and other local themes.
Phishing emails likely play a central role here. The attackers appear to entice victims into downloading an archive packaged with compression, after which an Inno Setup executable must be run. Choosing local, recognizable content makes it easier to build trust and lowers the barrier to running the installation.
Multi-stage attack with BYOVD via OPSWAT
The core of the attack is a multi-stage workflow. One of the main reasons Spark RAT draws attention is the use of BYOVD. In this approach, attackers load a “legitimate” driver that comes from a normal software component, but turns out to be vulnerable—so they can escalate privileges through that route.
In this case, the chain points to a driver associated with OPSWAT AppRemover (named as ardrv.sys). This approach also helps neutralize security software by terminating processes or creating exclusions.
From DLL sideloading to Spark RAT
The installer the user launches is designed to trigger a DLL sideloading chain. In the description, a signed Tencent component is used as part of the chain to make the next steps more believable and less conspicuous.
After that, a series of checks and payload actions follows. Among other things, the loader performs a timing-based anti-sandbox check: environments that shorten or manipulate sleep delays are identified. If the measured time falls outside the expected range, execution stops.
In addition, the loader checks whether a process related to Huorong Internet Security is running (with the named process HipsTray.exe). If such a process is found, the malware attempts to weaken the privileges of that security product.
Anti-sandbox and sabotage focused on processes
The attack is aimed not only at “getting it to run,” but also at “disabling protection as soon as it can.” According to Acronis, the chain then moves on to decrypting and executing shellcode hidden in a PNG file located inside the archive.
There is also a privilege check: the second stage determines whether the code runs with SYSTEM rights. Based on that, the payload chooses one of two execution modes.
- Inject mode: when already running with SYSTEM, the program immediately moves on to injection and saves the persistence component.
- Setup mode: if the malware is not running with SYSTEM, it first establishes persistence and then proceeds to the next phase.
Two modes: injection into vssvc.exe and persistence via Windows services
In both modes, injection into Windows processes plays an important role. The “inject mode” describes how the malware parses and decrypts shellcode from another PNG in the package, and then injects it into vssvc.exe. To keep the code running, the malware monitors the process and reinjects if vssvc.exe stops or restarts with a new PID.
In “setup mode,” the same shellcode source is used again, but with additional steps around persistence. The malware also checks a list of hard-coded processes associated with Qihoo 360. If those processes are not present, persistence is established via a mechanism based on Windows services. The result: the DLL sideloading cycle can be restarted when the service is launched.
After setting up that persistence, the payload injects again into vssvc.exe, allowing the chain to continue building toward its end goal.
Which security is targeted, and which techniques are used?
According to Acronis, Spark RAT then follows a sequence of actions aimed at suppressing detection and disrupting endpoint protection. The described steps include:
- attempts to patch functions related to AMSI and ETW;
- setting up persistence via a scheduled task;
- installing the vulnerable ardrv.sys driver to terminate security-related processes, with explicit examples such as Microsoft Defender, Huorong Internet Security, and Tencent PC Manager;
- decrypting yet another payload stored as a PNG in the archive, ultimately terminating hard-coded security processes in user-mode.
Additionally, a fourth PNG-driven component is processed. It contains shellcode injected into ctfmon.exe, which starts the execution path toward the final Spark RAT payload.
Why this matters for endpoint management
This campaign shows how attackers don’t just bypass security, but actively manipulate it. The combination of:
- phishing lures with locally recognizable themes,
- multi-stage payloads with hidden data in PNG files,
- DLL sideloading and anti-sandbox checks,
- and BYOVD to load a vulnerable driver,
creates a chain that is harder to block with a single measure.
In particular, targeted termination of security processes and patching functionality related to detection can impact incident visibility. If security software fails or becomes less effective, traces may go unnoticed for longer.
Comparisons with Silver Fox—though evidence remains limited
Acronis points to similarities with earlier “Silver Fox”-like activities: using DLL sideloading via a signed application, multi-trap payload delivery, persistence via Windows services and scheduled tasks, and excluding or bypassing Microsoft Defender.
At the same time, according to the researchers, there is not enough evidence to attribute the recent activity to the same actor with high confidence. There is no shared infrastructure, no clear function code reuse that tells the same story, and certificates do not match one-to-one.
Another nuance is that Spark RAT—unlike earlier campaigns—appears to use an open-source RAT as the final payload. The researchers state that a connection is not completely ruled out (operators can swap payloads), but it is weaker for attribution than the earlier “stronger” indicators.
Therefore, the current assessment is: an unattributed cluster with possible development or deployment relationships to a broader ‘Silver Fox’ environment, including hints of potential Chinese-language development or deployments, but with low reliability.
What can you do now? Concrete focus points
If you manage endpoints, it helps to focus on the approach rather than only on a single malware family. For example, look for signs of persistence via Windows services and scheduled tasks, unusual injection patterns targeting process names such as vssvc.exe and ctfmon.exe, and misuse of signed components for sideloading.
It’s also useful to test your own detections and response processes against scenarios in which security software is specifically disabled or where detection mechanisms (such as AMSI/ETW-like signals) are manipulated.
For broader context on how attacks can affect the endpoint and detection layers, you can also read about why MFA is not real identity and how attackers can still gain access. And if you’re especially focused on patterns of attacks that disrupt security tooling, GPUThor and Rowhammer are relevant as an example of how security approaches can be pressured through technical detours.
Conclusion
Spark RAT is part of a targeted campaign against Cambodia that doesn’t stop at “infect and done.” The attack combines phishing lures with a multi-stage delivery chain, uses BYOVD to raise privileges via a vulnerable driver, and then attempts to weaken security software by terminating processes and sabotaging detection components.
While there are similarities to a broader Silver Fox-like environment, attribution is not settled yet. For defenders, the lesson remains the same: look for patterns—persistence, injection, sideloading, and anti-detection—and verify whether your detections and response can actually break these chains.
Source: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html
