Cambodia-focused Spark RAT campaign turns OPSWAT's AppRemover driver into an EDR killer
Acronis says the operator borrowed a security vendor's own uninstall driver to shut down Defender on Cambodian machines, and the loader keeps three further ways to blind an agent if the kernel route fails.
The Watch · Security desk
What happened
- Acronis Threat Research Unit reported a campaign against individuals and organizations in Cambodia that delivers the open-source remote access trojan Spark RAT.
- Delivery is phishing with compressed archives holding an Inno Setup executable, using Cambodian government notices, public health announcements, dental examination records, real estate documents and promotional offers as lures.
- The installer starts a DLL side-loading chain through a signed Tencent executable, which drops interim payloads that stage the driver and then the RAT.
- One of those payloads installs OPSWAT's ardrv.sys, vulnerable to CVE-2026-36425, and uses it to terminate Microsoft Defender, Huorong Internet Security and Tencent PC Manager.
- Acronis found the artifacts between late June and early August 2026 and says it cannot tell whether the campaign is still running.
Why it matters
- capability A kernel-mode termination primitive signed by a security vendor removes the agent before it records the intrusion, so responders inherit hosts with no endpoint telemetry for the period that matters.
- exposure Any fleet that lets the vulnerable AppRemover driver load carries that primitive whether or not this operator ever mails it a lure, because the driver is legitimate and now documented.
- decision Of the four suppression steps, only the driver load is decided by policy rather than by detection quality, which is where the engineering hour buys the most.
- constraint Shared BYOVD driver sets and signed-binary sideloading limit how much clustering weight tooling overlap can carry, which is why Acronis describes Silver Fox-style indicators instead of an attribution.
Count the suppression steps and the design intent is legible. The DLL loader looks for Huorong Internet Security's HipsTray.exe and, if it is running, tries to weaken that product's privileges [11]. The payload patches AMSI and ETW functionality [15]. The installed driver terminates the named endpoint processes from the kernel [5]. A third PNG-embedded payload does the same job in user mode against a hard-coded process list [16]. That is four mechanisms aimed at one objective, and only one of them has to work [19].
The driver is a legitimate OPSWAT AppRemover component [4], so detecting the file means detecting a vendor's own uninstall tooling, and the operator gets a signed kernel primitive at no development cost. The event worth policing is the load itself, keyed to the vulnerable build. Deny it and the rest of the chain still runs, without the kernel option. Permit it and the endpoint stack goes quiet before Spark RAT is injected into ctfmon.exe and starts calling out [17].
The earlier stages are built to survive analysis rather than defeat it. The loader runs a timing check on sleep delays and quits if the elapsed time falls outside the expected range, which is aimed at sandboxes that accelerate sleeps [10]. The second stager branches on privilege: already SYSTEM, it goes straight to injection; otherwise it establishes persistence first, checking for Qihoo 360 processes before registering a Windows service [12][14]. Inject mode puts shellcode into vssvc.exe and then watches that process, re-injecting if it exits or comes back with a new PID [13]. Killing the injected thread does not end the session.
Acronis stops short of naming an actor. The BYOVD routine references TrueSight and Zemana Anti-Malware SDK drivers, both used by Silver Fox before dropping Winos 4.0, and the Huorong targeting matches repeated past Silver Fox activity, as do the targeting overlaps and the sideloading through a signed application [7][8]. Read that as toolkit lineage rather than identity. Spark RAT is open source and Go-based [2], the driver set is public, and every component here is copyable by the next crew.
The dating gives about six weeks of artifacts [18], which is a short observation window and not evidence of a short campaign. For anyone with Cambodian operations or staff, the checkable item is whether the vulnerable ardrv.sys build can load on the fleet at all.
What to watch
- Whether OPSWAT ships a fixed AppRemover driver and whether the vulnerable ardrv.sys build reaches vendor driver blocklists.
- Whether any researcher reports this chain running past early August 2026 or aimed outside Cambodia.
- Whether the ardrv.sys routine turns up in an intrusion firmly attributed to Silver Fox rather than merely resembling one.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Acronis Threat Research Unit researchers Darrel Virtusio and Subhajeet Singha published an analysis on Wednesday describing a new campaign targeting individuals and organizations in Cambodia with the open-source remote access trojan Spark RAT.
- [2]
Spark RAT is an open-source, Go-based, cross-platform RAT that enables remote control of compromised devices.
- [3]
Attack chains likely use targeted phishing emails carrying compressed archives that contain an Inno Setup executable, with lures including Cambodian government notices, public health announcements, dental examination records, real estate documents and promotional offers.
- [4]
The multi-stage attack uses the bring your own vulnerable driver technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover, ardrv.sys, to escalate privileges and neutralize security software.
- [5]
The payload installs the ardrv.sys driver, which is vulnerable to CVE-2026-36425, to terminate security-related processes including Microsoft Defender, Huorong Internet Security and Tencent PC Manager.
- [6]
The Inno Setup installer triggers a DLL side-loading chain using a signed Tencent executable, which delivers interim payloads that deploy ardrv.sys and launch the Spark RAT payload.
- [7]
The BYOVD routine references other drivers including those part of TrueSight and Zemana Anti-Malware SDK, both of which were used by the Silver Fox threat actor prior to dropping Winos 4.0, also known as ValleyRAT.
- [8]
Targeting of Huorong security processes has been repeatedly observed in past Silver Fox-related attacks, and other Silver Fox-style indicators include targeting overlaps and the use of DLL sideloading through a signed application.
- [9]
Acronis said it discovered a number of malicious artifacts between late June and early August 2026, and that it is unclear whether the campaign remains ongoing.
- [10]
The DLL loader performs a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and terminates execution if the elapsed time falls outside the expected range.
- [11]
The loader reviews running processes for Huorong Internet Security's HipsTray.exe and, if present, attempts to weaken the privileges of that security product.
- [12]
Shellcode is concealed within PNG files in the archive; a second stager verifies whether it is running with SYSTEM privileges and on that basis selects either inject mode or setup mode.
- [13]
Inject mode decrypts shellcode from a PNG file, injects it into vssvc.exe, and monitors that instance, re-injecting if the process terminates or restarts with a new PID.
- [14]
Setup mode checks for a list of hard-coded processes associated with Qihoo 360 and, if none are found, sets up Windows service-based persistence to relaunch the sideloading cycle.
- [15]
The payload attempts to patch AMSI and ETW related functionality and sets up persistence using a scheduled task.
- [16]
A third PNG-embedded payload is decrypted to perform user-mode termination of hard-coded security processes.
- [17]
A fourth PNG-based payload file yields shellcode that is injected into ctfmon.exe, leading to execution of Spark RAT.
- [18]
The observed artifact window runs about six weeks.
- [19]
The chain contains four distinct mechanisms for suppressing endpoint security, of which one operates in the kernel.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comNew campaign targets Cambodia with Spark RAT using BYOVD technique
1 article · August 28, 2026
- thehackernews.comSpark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
2 articles · August 27, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.