Threat Attribution Uncertainty

Cambodia-focused Spark RAT campaign turns OPSWAT's AppRemover driver into an EDR killer

Acronis says the operator borrowed a security vendor's own uninstall driver to shut down Defender on Cambodian machines, and the loader keeps three further ways to blind an agent if the kernel route fails.