Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
An open-source remote access trojan, Spark RAT, is targeting Cambodia with diverse lures and employing a vulnerable OPSWAT driver to disable security software.
A new cyber campaign is actively targeting individuals and organizations in Cambodia, deploying an open-source remote access trojan (RAT) known as Spark RAT. Researchers at the Acronis Threat Research Unit (TRU) observed a variety of lure themes used in this campaign, including official government notices, public health materials, real estate advertisements, and other relevant topics, indicating an effort to ensnare a broad spectrum of potential victims.
The attack chain begins with phishing emails that distribute compressed archives. These archives contain an Inno Setup executable, which, when run by unsuspecting recipients, initiates a multi-stage process. A key element of this attack is the use of the "bring your own vulnerable driver" (BYOVD) technique. This involves loading a legitimate but vulnerable driver, specifically "ardrv.sys" from OPSWAT AppRemover, to gain elevated privileges and disable security tools on the compromised system.
The initial Inno Setup installer is designed to trigger a DLL side-loading chain. It leverages a signed Tencent executable to deliver intermediate payloads. These payloads are responsible for loading the vulnerable "ardrv.sys" driver and subsequently launching the Spark RAT. Spark RAT itself is a cross-platform RAT developed in Go, providing attackers with comprehensive remote control over infected devices.
During its execution, the DLL loader performs anti-sandbox checks, looking for environments that manipulate or shorten sleep delays. If such an environment is detected, the malware terminates its execution. It also scans for running processes associated with Huorong Internet Security, a Chinese endpoint security solution. If detected, the loader attempts to reduce the security product's privileges, further weakening the system's defenses.
The malware then decrypts shellcode hidden within a PNG file to execute a second stage. This stage verifies if it has SYSTEM privileges. If it does, it proceeds directly to an "inject mode" to bypass persistence setup and execute the next stage. If not, it enters a "setup mode" to establish persistence before proceeding. In "inject mode," shellcode is decrypted from another PNG file and injected into the "vssvc.exe" process, with the malware monitoring and re-injecting if the process terminates. In "setup mode," it checks for the presence of Qihoo 360 security processes. If none are found, it establishes persistence via a Windows service, which then relaunches the entire infection cycle.
Once persistence is established, the payload executes a series of actions. It attempts to patch functionalities related to AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows), sets up persistence using a scheduled task, and installs the vulnerable "ardrv.sys" driver to terminate security processes like Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. It then decrypts and injects further shellcode into "ctfmon.exe" to finally execute Spark RAT.
Interestingly, the BYOVD routine references drivers used by the Silver Fox threat actor, and the targeting of Huorong security products aligns with previous Silver Fox activities. However, Acronis notes that definitive attribution to Silver Fox is difficult due to the absence of shared infrastructure, code reuse, and matching certificates. A key differentiator is the use of an open-source RAT like Spark RAT, which has not been previously linked to Silver Fox campaigns. While operators can change payloads, this difference weakens the attribution link. The Spark RAT configuration contains Chinese-language elements, and it targets security products common in Chinese-speaking regions, leading Acronis to track this as an unattributed cluster with possible Chinese development or operational links to the broader Silver Fox ecosystem, albeit with low confidence.