Ethical Hacking News
A new malware campaign known as Spark RAT has emerged, targeting vulnerable systems in Cambodia. The campaign employs an open-source remote access trojan (RAT) to deliver a multi-stage attack, utilizing a bring-your-own-vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover to escalate privileges and neutralize security software. The campaign has been notable for its use of phishing emails and DLL sideloading to distribute the malware. While the attribution of the campaign to the Silver Fox threat actor remains uncertain, the similarities between the two are striking. As the threat landscape continues to evolve, it is essential for organizations to remain vigilant and take proactive measures to protect themselves against such sophisticated attacks.
The Spark RAT malware campaign is targeting vulnerable systems in Cambodia, utilizing a complex multi-stage attack. The campaign employs a bring-your-own-vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver to escalate privileges. The attack chains involve phishing emails with compressed archives containing Inno Setup executables, which deliver interim payloads to deploy Spark RAT. The malware performs various actions, including patching AMSI and ETW functionality, setting up persistence, and installing a vulnerable driver to terminate security software. The Spark RAT configuration contains a Chinese-language value, suggesting possible Chinese-language development or deployment links. The activity is being tracked as an unattributed cluster with possible operational similarities to the broader Silver Fox ecosystem.
The cybersecurity landscape has recently witnessed the emergence of a complex and sophisticated malware campaign known as Spark RAT, which has been targeting vulnerable systems in Cambodia. According to recent reports, this campaign has been utilizing an open-source remote access trojan (RAT) called Spark RAT, which has been employed to deliver a multi-stage attack. The campaign has been notable for its use of a bring-your-own-vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover ("ardrv.sys") to escalate privileges and neutralize security software.
The campaign is believed to have begun in late June 2026 and has been ongoing, with Acronis Threat Research Unit (TRU) researchers identifying a number of malicious artifacts between then and early August 2026. The attack chains are thought to involve targeting phishing emails to distribute compressed archives containing an Inno Setup executable and trick recipients into running it using wide-ranging lures, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers.
The Inno Setup installer is designed to trigger a DLL side-loading chain using a signed Tencent executable, which then delivers interim payloads responsible for deploying the vulnerable "ardrv.sys" and then launching the Spark RAT payload. The DLL loader also carries out a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and proceeds to terminate execution if the elapsed time falls outside the expected range. Furthermore, it reviews running processes for those related to Huorong Internet Security ("HipsTray.exe"), a Chinese endpoint security program.
If the process is present, the loader attempts to weaken the privileges of the security product. In the next stage, it decrypts shellcode concealed within a PNG file present in the archive to run a second stager, which verifies if it is running with SYSTEM privileges. The payload selects one of two execution modes, with the first mode involving inject mode, which bypasses the persistence setup and executes the next stage. The second mode involves setup mode, where the malware establishes persistence first, then executes the next stage.
The inject mode works by parsing and decrypting shellcode embedded in another PNG file from the archive, and then injecting it into "vssvc.exe" and executing it within the context of the target process. To ensure the injected payload remains running, it monitors the "vssvc.exe" instance and re-injects the shellcode if the process terminates or restarts with a new PID. In the setup mode, the malware reads and decrypts the shellcode from the same file, after which it checks for a list of hard-coded processes associated with Qihoo 360. If none of them are found, it sets up a Windows service-based persistence mechanism to launch the binary that sideloads the DLL to relaunch the entire cycle all over again.
The payload performs a series of actions, including attempting to patch AMSI and ETW related functionality, setting up persistence using a scheduled task, installing the ardrv.sys driver that's vulnerable to CVE-2026-36425 to terminate security-related processes such as Microsoft Defender, Huorong Internet Security, and Tencent PC Manager, reading and decrypting another embedded payload from a third PNG file to perform user-mode termination of hard-coded security processes, and simultaneously processing a fourth PNG-based payload file to extract and decrypt shellcode that's injected into "ctfmon.exe," ultimately leading to the execution of Spark RAT.
Interestingly, the BYOVD routine references a number of other drivers, including those part of TrueSight and Zemana Anti-Malware SDK, both of which have been used by the Silver Fox threat actor prior to dropping Winos 4.0 (aka ValleyRAT). Additionally, the targeting of Huorong security processes has been repeatedly observed in past Silver Fox-related attacks. Other Silver Fox-style indicators include targeting overlaps, the use of DLL sideloading through a signed application, multi-stage payload delivery, persistence through Windows services and scheduled tasks, and Microsoft Defender exclusions.
Despite the similarities, there is not enough evidence to definitively attribute the latest activity to the threat actor. The assessment is based on the absence of shared infrastructure, function-level code reuse, and matching certificates. Furthermore, the choice of malware itself is different from previous Silver Fox campaigns, which have been known to leverage ValleyRAT and other custom payloads. The Spark RAT configuration contains a Chinese-language value, and the malware targets several security products commonly used in Chinese-speaking environments.
Therefore, the activity is being tracked as an unattributed cluster with possible Chinese-language development or deployment links and operational similarities to the broader Silver Fox ecosystem. The assessment remains low confidence and may change if additional code, infrastructure, victimology, or other attributional evidence is identified.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Sophisticated-Tactics-of-Spark-RAT-A-Malware-Campaign-Targeting-Vulnerable-Systems-in-Cambodia-ehn.shtml
https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html
Published: Sat Aug 29 21:25:57 2026 by llama3.2 3B Q4_K_M
