Cambodian entities are currently facing a new, sophisticated cyber threat utilizing the **Spark RAT**. Researchers at **Acronis Threat Research Unit (TRU)**, **Darrel Virtusio** and **Subhajeet Singha**, detailed the campaign's multi-stage infection chain and its use of diverse, localized lures.  ### BYOVD for Privilege Escalation Central to this attack is the 'bring your own vulnerable driver' (BYOVD) technique. Threat actors exploit a legitimate but vulnerable driver associated with **OPSWAT AppRemover** (**ardrv.sys**) to achieve privilege escalation and neutralize endpoint security solutions. ### Diverse Lures and Initial Access The attack likely begins with targeted phishing emails delivering compressed archives. These archives contain an **Inno Setup** executable, which victims are tricked into running. Lures are highly varied and localized, including Cambodian government notices, public health materials, dental examination records, real estate documents, and promotional offers. **Acronis** observed malicious artifacts associated with this campaign between late June and early August 2026, though its current status is unconfirmed. ### Multi-Stage Infection Chain The **Inno Setup** installer initiates a DLL side-loading chain using a signed **Tencent** executable. This process delivers interim payloads that deploy the vulnerable `ardrv.sys` driver and subsequently launch the **Spark RAT** payload. **Spark RAT** is an open-source, Go-based, cross-platform RAT designed for remote control of compromised devices. ### Evasion and Persistence The DLL loader incorporates anti-sandbox checks, terminating execution if timing-based delays are manipulated. It also scans for processes related to **Huorong Internet Security** (`HipsTray.exe`), a Chinese endpoint security program, and attempts to weaken its privileges if detected. Further stages involve decrypting shellcode from an embedded PNG file to run a second stager. This stager verifies if it's running with `SYSTEM` privileges, leading to one of two execution modes: * **Inject Mode**: If already `SYSTEM`, it directly injects shellcode (from another PNG) into `vssvc.exe`, monitoring and re-injecting if the process terminates. * **Setup Mode**: If not `SYSTEM`, it first establishes persistence, then proceeds with injection. This mode checks for **Qihoo 360** processes and, if none are found, sets up a Windows service-based persistence mechanism to relaunch the DLL sideloading cycle.  ### Final Payload Delivery The malware performs several critical actions: * Attempts to patch **AMSI** and **ETW** functionalities. * Sets up persistence via a scheduled task. * Installs `ardrv.sys` (vulnerable to **CVE-2026-36425**) to terminate security processes like **Microsoft Defender**, **Huorong Internet Security**, and **Tencent PC Manager**. * Decrypts a third embedded payload from a PNG for user-mode termination of security processes. Simultaneously, a fourth PNG-based payload extracts and decrypts shellcode, injecting it into `ctfmon.exe`, ultimately executing the **Spark RAT**. ### Potential Link to Silver Fox Interestingly, the BYOVD routine references drivers also used by the **Silver Fox** threat actor, such as those from **TrueSight** and **Zemana Anti-Malware SDK**. Other similarities to **Silver Fox** campaigns include targeting overlaps, DLL sideloading via signed applications, multi-stage payload delivery, persistence mechanisms (Windows services and scheduled tasks), and **Microsoft Defender** exclusions. Despite these operational resemblances, **Acronis** notes a lack of definitive evidence for attribution, such as shared infrastructure, code reuse at the function level, or matching certificates. A key differentiator is the choice of malware; **Silver Fox** typically uses **ValleyRAT** (also known as **Winos 4.0**) and custom payloads, not open-source RATs like **Spark RAT**. **Acronis** states: "This difference does not rule out a relationship, since operators can change payloads, but it removes one of the stronger links used in previous attributions." The **Spark RAT** configuration contains Chinese-language values, and it targets security products common in Chinese-speaking environments. Therefore, **Acronis** currently tracks this activity as an "unattributed cluster with possible Chinese-language development or deployment links and operational similarities to the broader **Silver Fox** ecosystem," with low confidence, pending further evidence.