A newly identified cyber campaign is zeroing in on individuals and organizations in Cambodia, distributing an open-source remote access trojan (RAT) dubbed Spark RAT. The attack strain, documented between late June and early August 2026, employs phishing lures themed around government notices, health alerts, dental records, real estate, and promotional materials to trick victims into executing malicious payloads.
How the Attack Chain Works
The campaign begins when targets receive phishing emails carrying compressed archives. These archives contain a Windows installer built using Inno Setup. When run, the installer sideloads a DLL via a signed Tencent executable, which acts as the middleman to install a vulnerable driver, ardrv.sys — part of OPSWAT’s AppRemover tool — to elevate privileges and disable security apps.
Once the driver is planted, several steps follow to ensure deep control: first, Spark RAT checks whether it has SYSTEM-level access. If it does, it proceeds with injecting shellcode; if not, it sets up persistence through scheduled tasks or Windows services before injection. The shellcode itself is hidden inside PNG image files included in the archive. It’s decrypted, injected into legitimate processes like vssvc.exe and ctfmon.exe, re-injected if those processes restart, and used to neutralize security services and software from Microsoft, Tencent, and Huorong.
Key Features and Attribution Efforts
The attackers employed a “bring-your-own-vulnerable-driver” (BYOVD) tactic, using the OPSWAT AppRemover’s vulnerable driver (CVE-2026-36425) to bypass security defenses. They also incorporated anti-sandbox timing checks and process detection logic to avoid running in virtual environments or being discovered by similar security tools. Huorong Internet Securityand products from Tencent are both directly targeted.
While the operation shares many hallmarks with the so-called Silver Fox threat actor — including targeting specific security tools, DLL sideloading via signed applications, multi-stage payloads, and persistence methods — there’s insufficient proof to confirm a direct link. Differences include the use of an open-source RAT rather than custom payloads, and the absence of shared infrastructure or certificates that typify previous Silver Fox attacks. Analysts estimate there may be language or deployment ties to Chinese-speaking environments, but this remains speculative.
The campaign’s current status is unclear; researchers have not confirmed if Spark RAT attacks are still active beyond early August 2026.
What Spark RAT Is
Spark RAT is a Go-based open-source remote access trojan capable of running on multiple platforms. Once installed, it allows adversaries to take full control of compromised devices, including executing arbitrary commands, disabling security features, and maintaining persistent access. Its modular design coupled with stealth techniques such as icon misdirection, driver exploits, and process injections increases its potency.
For Cambodia, a country with growing concerns around digital security, this campaign highlights heightened risks. Government and health institutions are historically attractive targets due to their limited cyber defenses and the trust the public places in their communications. Disguising malicious emails as official notices or health documents makes it harder for non-technical users to spot the danger.
It’s not just Cambodians who should take notice. Any environment where users rely on vulnerable drivers, weakly monitored endpoints, or lack robust detection tools can be exposed. Spark RAT’s ability to leverage a legitimate driver to bypass security is especially alarming — it shows how attackers are increasingly abusing the supply and trust chain of security tools themselves.
What to Watch For:Be wary of compressed email attachments and executables that look like official notices. Keep drivers and anti-malware software up to date. Monitor process behavior and check for unexpected services or scheduled tasks. Disabling or denying vulnerable drivers is an option when patches aren’t available. Defensive tools should also look for PNGs that may contain embedded payloads as part of multi-stage attacks.
While attribution remains unsettled, this campaign underscores evolving tactics in threat actor toolkits — especially when it comes to leveraging legitimate components in attacks. For defenders, the lesson is clear: trust a tool chain less, inspect more.
