Spark RAT Targets Cambodia via Vulnerable OPSWAT Driver
A phishing campaign targeting individuals and organizations in Cambodia is delivering the open-source Go-based remote access trojan Spark RAT through lures themed as government notices, public health announcements, dental records, real estate documents, and promotional offers. Acronis Threat Research Unit researchers Darrel Virtusio and Subhajeet Singha said they found multiple malicious artifacts between late June and early August 2026, although it remains unclear whether the campaign is still active. Recipients are encouraged to check whether their credentials have been exposed with the email breach checker.
The multi-stage attack begins with a compressed archive containing an Inno Setup installer. Running the file triggers DLL side-loading through a legitimate signed Tencent executable, which loads a vulnerable OPSWAT AppRemover driver, `ardrv.sys`, using the bring-your-own-vulnerable-driver technique. The driver is abused to gain elevated privileges and disable or weaken endpoint security protections.
The loader performs a timing-based anti-sandbox check, terminating when observed sleep delays do not match expectations. It also searches for `HipsTray.exe`, associated with Huorong Internet Security, and attempts to reduce that security product's privileges. Subsequent stages decrypt shellcode hidden in PNG files embedded in the archive, with execution depending on whether the malware has already obtained SYSTEM-level access.
When running as SYSTEM, Spark RAT skips persistence and enters an injection mode that decrypts another PNG-embedded payload, injects it into `vssvc.exe`, and monitors the process so the shellcode can be reloaded if it exits or restarts under a new PID. If SYSTEM privileges are not present, the malware establishes persistence before continuing. The campaign demonstrates how ordinary phishing lures can escalate into remote system control, making defensive reviews such as HackMyIP's privacy checkup useful for identifying additional exposure risks.