Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Summary: A campaign targeting individuals and organizations in Cambodia delivers the open-source, Go-based Spark RAT through phishing emails carrying Inno Setup installers disguised as government notices, public health materials, dental records, real estate documents, and promotional offers. The chain uses a signed Tencent executable for DLL side-loading and the BYOVD technique to load a vulnerable OPSWAT AppRemover driver ("ardrv.sys") to escalate privileges and disable security software, with Acronis finding malicious artifacts between late June and early August 2026.
Why it matters: The attackers did not need a zero-day: they loaded a legitimate but vulnerable OPSWAT driver to gain kernel-level privilege and switch off endpoint protection, a technique Acronis also ties to prior Silver Fox activity using TrueSight and Zemana drivers. Acronis rates the Silver Fox link low confidence, so the operator behind this chain remains unidentified.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026