Full Report
Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics," Acronis Threat
Analysis Summary
# Tool/Technique: Spark RAT (Cambodia Campaign)
## Overview
This entry details a 2026 campaign targeting Cambodian individuals and organizations. The attack utilizes a multi-stage infection chain involving localized lures, DLL side-loading, and a Bring Your Own Vulnerable Driver (BYOVD) technique to deploy **Spark RAT**, an open-source remote access trojan.
## Technical Details
- **Type:** Malware Family (RAT) / Multi-stage Infection Chain
- **Platform:** Windows (Cross-platform Go-based)
- **Capabilities:** Remote control, security software termination, persistence, process injection, and anti-analysis.
- **First Seen:** June 2026 (Campaign cluster)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059 - Command and Scripting Interpreter]
- **[TA0003 - Persistence]**
- [T1543.003 - Create or Modify System Process: Windows Service]
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- **[TA0004 - Privilege Escalation]**
- [T1068 - Exploitation for Privilege Escalation] (BYOVD)
- [T1574.002 - DLL Side-Loading]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (BYOVD via ardrv.sys)
- [T1027.003 - Obfuscation: Steganography] (Shellcode in PNG files)
- [T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion]
- [T1055 - Process Injection]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
* **Remote Administration:** Leverages the open-source Spark RAT (Go-based) for full command and control over the target.
* **Multi-Stage Loading:** Uses Inno Setup installers to initiate a complex execution chain involving Tencent-signed executables and DLL side-loading.
* **Persistence:** Establishes recurring execution through both Windows Services (if SYSTEM privileges are obtained) and Scheduled Tasks.
### Advanced Features
* **BYOVD (Bring Your Own Vulnerable Driver):** Exploits **CVE-2026-36425** in the legitimate OPSWAT AppRemover driver (`ardrv.sys`) to escalate privileges and terminate kernel-mode security processes.
* **Steganography:** Interim shellcode and payloads are concealed within PNG image files to evade static file analysis.
* **Targeted Evasion:** Specific routines designed to identify and weaken Chinese security products including **Huorong Internet Security** (`HipsTray.exe`) and **Qihoo 360**.
* **Anti-Sandbox:** Timing-based checks monitor `Sleep` delays; if the environment manipulates time to speed up analysis, the malware terminates.
* **Process Guarding:** Injects into `vssvc.exe` and monitors the process, re-injecting if the process is terminated.
## Indicators of Compromise
* **File Names:** `ardrv.sys` (Vulnerable OPSWAT driver), `HipsTray.exe` (Targeted for termination).
* **Vulnerability:** CVE-2026-36425.
* **Network Indicators:** [C2 indicators not explicitly provided in source text; typically interacts via web protocols].
* **Behavioral Indicators:**
* Loading of `ardrv.sys`, `truesight.sys`, or Zemana drivers by non-security processes.
* Injection of shellcode into `vssvc.exe` and `ctfmon.exe`.
* Anomalous `Inno Setup` execution from email attachments.
## Associated Threat Actors
* **Silver Fox** (Reference made to shared TTPs/drivers).
* Campaign specifically focused on **Cambodian** government and public sectors.
## Detection Methods
* **Signature-based:** Detect the specific Spark RAT Go-binary signatures and the MD5/SHA256 of the vulnerable `ardrv.sys` driver.
* **Behavioral:** Monitor for unauthorized driver loading (especially known vulnerable drivers) and attempts to patch AMSI/ETW.
* **Process Monitoring:** Alert on unexpected injections into `vssvc.exe` or `ctfmon.exe`.
## Mitigation Strategies
* **Driver Blocklisting:** Implement Microsoft’s recommended driver blocklist to prevent the loading of known vulnerable drivers like `ardrv.sys`.
* **Endpoint Protection:** Use EDR solutions that detect DLL side-loading and process injection attempts.
* **User Training:** Educate staff on phishing lures involving government notices and dental/real estate documents.
* **System Hardening:** Enforce the principle of least privilege to prevent the initial installer from gaining administrative rights needed for service creation.
## Related Tools/Techniques
* **Spark RAT:** Open-source Go-based RAT.
* **BYOVD Drivers:** Zemana Anti-Malware SDK, TrueSight.
* **Side-loading:** Abusing legitimate Tencent signed executables.