Cambodia-focused cluster uses multistage infection chain with localized lures

Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. Cambodia has become an increasingly significant regional security and geopolitical focal point, with deepening China–Cambodia security cooperation and continued reporting of China-linked cyber activity targeting Cambodian organizations.

However, our targeting assessment is based primarily on the archive names and Cambodia-related subjects. These indicators suggest that the material was designed to appeal to Cambodian recipients, but do not by themselves establish the full scope of the campaign. We observed similar samples in the wild from late June through early August, indicating that the activity has persisted for at least several weeks. However, this evidence is insufficient to confirm whether the campaign is still ongoing.

The analyzed campaign begins with an Inno Setup executable and when executed, it performs a multi-stage attack chain that includes DLL sideloading, anti-analysis checks, token manipulation, persistence, shellcode decryption during run-time present inside PNG files, process injection, and the deployment of a vulnerable driver through Bring Your Own Vulnerable Driver (BYOVD) technique before ultimately deploying its final payload. The final embedded PE is identified as SparkRAT , and the analyzed execution showed communication with sx[.]nuihuw[.]com over port 443. The activity shares elements of the tradecraft documented in research on SilverFox through its use of DLL sideloading, multi-stage payload delivery, persistence through services and scheduled tasks, and the use of vulnerable drivers to disable security products; however, the available evidence is insufficient to establish a definitive attribution.

This research provides a detailed technical analysis of the campaign, including its infection chain and the behavior of its loader and payloads.

Several compressed archives appear to be connected to the same campaign. The file names cover a range of subjects including Cambodian government notices, public health announcements, dental examination records, real estate documents, among others. Several filenames directly reference Cambodia or subjects likely to be relevant to Cambodian users. This provides the main basis for assessing the activity as Cambodia-focused.

The analyzed archive is consistent with a targeted-phishing delivery scenario, although we did not observe the email or other delivery telemetry associated with the sample. The compressed archive contains an Inno Setup Installer named “Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe”. The filename and COVID-19-themed lure suggest an attempt to appeal to Cambodian users’ interest in government announcements related to COVID-19. Upon execution, the installer creates a hidden directory at C:\Drivers, along with the subdirectories \mQm and \XF, and drops the remaining components into these locations. The executable F7u00ex.exe is a signed binary associated with Tencent Corporation and is used to sideload the malicious DLL WfoY.qf.

The loader employs exception-based control flow by registering a custom VEH. It will then trigger STATUS_BREAKPOINT exception via __debugbreak(), causing the VEH to invoke the main malware routine.

After hitting the exception handler and entering its main routine, the loader performs a timing-based anti-sandbox check before continuing its execution. The loader performs a timing-based anti-sandbox check intended to detect environments that shorten or manipulate sleep delays. If the elapsed time falls outside the expected range, the loader terminates execution.

, the loader will start enumerating the first encrypted payload. It then retrieves the directory and appends the following filename “56360VK1ES8.yvap” which is one of the PNG component files dropped earlier.

Before reading the PNG file, the loader first checks processes related to Huorong Internet Security a lightweight, Chinese-developed antivirus and endpoint-security product widely used in China, making it a relevant security product to monitor and combat while targeting broader East Asian environments. When one of these processes is found, the loader enters a token-manipulation routine. Internal strings such as “huorong detected, blinding”, “downgrade begin”, and “stripping privileges” suggest that the routine is intended to weaken the privileges of the security product. Below is the list of the processes related to Huorong Internet Security.

After locating the Huorong Internet Security processes, the malware begins to “blind” by systematically removing security privileges from the target. It parses the string “downgrade begin” for logging purposes, which is one of the key attack tactics for performing defense impairment across the target environment.

And it first checks its current process token by verifying whether the token is S-1-5-18 or NT AUTHORITY\SYSTEM. If the condition is true, it will skip impersonation. Otherwise, it searches for winlogon.exe and accesses its SYSTEM token for impersonation.

When the current process is not running as SYSTEM, it searches for winlogon.exe. The loader accesses winlogon.exe's SYSTEM token for impersonation. Once the process is located, it opens the process and accesses its security token using OpenProcessToken and immediately proceeds with impersonating the SYSTEM token from winlogon.exe.

The loader proceeds to immediately remove a set of privileges from the duplicated token and set its Mandatory Integrity Level to Untrusted.

Once the token manipulation routine completes, the loader implant then proceeds to process the PNG file. It first resolved the APIs NtCreateFile and NtReadFile and checked whether it is a valid PNG.

The routine then parses the IDAT chunk and verifies the presence of the IEND chunk to ensure that the PNG structure is complete. After validating the IDAT chunk, it concatenates the data from all IDAT chunks into a single continuous buffer. At this stage, the malware treats the concatenated IDAT data as the encrypted payload, which is subsequently passed to later routines for decompression and eventual decryption of the stage of payload.

After dumping the embedded payload from 56360VK1ES8.yvap, it was confirmed that the payload from 56360VK1ES8.yvap is a 64-bit PE file. The payload verifies again whether it is running with SYSTEM privileges by checking whether the SID is S-1-5-18. The result of this privilege check determines which execution mode it will follow. Afterwards, it will check whether the “TaskHandler” service already exists.

Based on these checks, the payload selects one of two execution modes. If it is already running as SYSTEM, it proceeds directly to inject mode, bypassing the persistence setup and executing the stage. Otherwise, it enters setup mode, where it establishes persistence first, then executes the stage.

As the payload goes into inject mode, it reads and decrypts the raw shellcode embedded in BssBfeFFoA3A.nz which is another PNG file component dropped earlier.

It then injects the decrypted shellcode into vssvc.exe and executes it within the target process.

The malware then enters a monitoring loop that tracks the injected vssvc.exe instance. If the process terminates or restarts with a new PID, the malware reinjects the shellcode.

If the payload is not running as SYSTEM, it enters the setup mode and begins to read and decrypt the BssBfeFFoA3A.nz file, similar to inject mode. After decryption, it first checks for hardcoded 360 Security processes. If it detects that there are 360 Security related processes, it then injects the decrypted raw shellcode to vssvc.exe. Qihoo 360 is a major Chinese cybersecurity vendor, making its presence particularly relevant when assessing malware targeting Chinese and broader East Asian environments. The loader's explicit process checks therefore suggest deliberate awareness of the security products commonly deployed on its intended victims. Below is the list of processes that it checks:

If none of the listed processes are found, it will instead create a Windows Service that will continuously run the executable F7u00ex.exe as its persistence mechanism. It constructs and builds a command line to start the executable in which becomes:

cmd /c cd /d "C:\Drivers\mQm" && start "" "C:\Drivers\mQm\F7u00ex.exe"

The payload then constructs the sc.exe commands to create and start the Windows Service:

sc create TaskHandler binPath="cmd /c cd /d \"C:\Drivers\mQm\" && start \"\" \"C:\Drivers\mQm\F7u00ex.exe\"" start= auto

sc failure TaskHandler reset=0 actions=restart/1000

After creating its persistence mechanism, it will now proceed to inject the shellcode from BssBfeFFoA3A.nz into vssvc.exe.

After setting up Windows Service and injecting the shellcode to vssvc.exe, it will then process another PNG-based payload file named d7zzQhzRglBv.es. The decrypted content is injected into ctfmon.exe.

The payload recovered from BssBfeFFoA3A.nz runs inside vssvc.exe. It carries out multiple operations including attempts to patch AMSI and ETW related functionality, reflective PE loading, another persistence mechanism by creating a scheduled task, installing a vulnerable driver for terminating security-related processes, and reading and decrypting another embedded payload from the PNG file cnV.rb.

Before performing its main operation, the shellcode first performs the patching of AMSI and ETW as its initial defense impairment technique. Afterwards, it will then proceed to load the PE into memory.

In addition to the TaskHandler service created by the earlier stage, it also proceeds to create a scheduled task as another persistence mechanism. It constructs the following command:

schtasks /create /tn "TaskHandler" /tr "C:\Drivers\mQm\F7u00ex.exe" /sc ONSTART /ru "NT AUTHORITY\SYSTEM" /rl HIGHEST

After creating another persistence mechanism, it configures Microsoft Defender exclusions by adding registry entries and adding exclusions for VSSVC.exe, ctfmon.exe, C:\Drivers, and C:\Windows\System32 directory. These exclusions are intended to reduce scanning of the locations and processes used to store or execute the later stages.

The same stage installs ardrv.sys, a driver associated with OPSWAT AppRemover. The recovered driver version is affected by CVE-2026-36425, which concerns IOCTL 0x2420031 and permits local users to submit process-termination requests without adequate privilege validation. During analysis, we observed the malware communicating with the driver, invoking the vulnerable IOCTL, and successfully terminating processes. This behavior is consistent with the use of ardrv.sys as part of a Bring Your Own Vulnerable Driver (BYOVD) operation.

Using the kernel-mode capabilities provided by the vulnerable driver, it proceeds to terminate AV-related processes from 360 Total Security, Huorong Internet Security, Microsoft Defender, and Tencent PC Manager.

The targeted processes span security interfaces, scanning engines, background services, and real-time protection components. Their termination would remove multiple layers of user-mode protection, allowing the loader to proceed with execution. This behavior further demonstrates the loader's deliberate targeting of 360 Total Security and its associated security components, along with that targeting other anti-malware products as well, such as:

Additional vulnerable drivers are referenced in the payload strings. These references may indicate support for additional vulnerable drivers, although their use was not confirmed.

Lastly, the payload will also construct the path to another file under the same directory, cnV.rb. Like the earlier payload containers, it is also a PNG file.

It then performs a similar routine to extract the encrypted payload and decrypt and inject it into svchost.exe. Before it proceeds to injection process, it first filters out a particular svchost.exe instance that it considers “safe” to be injected.

It filters out the safe svchost.exe instance by enumerating specific Windows Services, determining the PID, and deliberately avoids svchost.exe instances that are running critical services. These services are:

It also checks whether that specific svchost.exe instance is running as SYSTEM before finally injecting the decrypted payload from cnV.rb.

The payload recovered from cnV.rb is injected into svchost.exe and performs an additional defense-impairment routine. Previously, the malware installed a vulnerable driver to terminate processes in kernel mode. This time, it handles user mode. First, it enables SeDebugPrivilege, allowing it to obtain higher privileges when interacting with security software. Afterwards, it will proceed to its termination routine where it iterates through the hardcoded list of security processes and terminates them via TerminateProcess API.

The payload recovered from d7zzQhzRglBv.es is injected into ctfmon.exe. The primary routine is to reflectively load an embedded PE payload into memory.

Upon recovering the embedded PE payload, we identified it as SparkRAT. SparkRAT is an open-source, cross-platform remote access trojan written in Go and developed by XZB-1248. The project was publicly released in 2022.

It decrypts its embedded configuration using AES-CTR. After decryption, it verifies the integrity of the recovered data by comparing a stored MD5 value with the MD5 hash of the decrypted configuration.

Once validated, the configuration is loaded into memory and used for subsequent operations. The decrypted configuration reveals the primary C2 server (sx.nuihuw.com), which communicates over port 443, a unique client identifier (UUID), and a 256-bit cryptographic key used during communication. It also contains a note field with the Unicode value \u9ed8\u8ba4, which translates to the Chinese characters "默认", meaning "Default". Additionally, the configuration specifies a backup C2 server, nuihuw.top, allowing the malware to continue communicating if the primary server becomes unavailable.

{ "secure": true, "host": "sx.nuihuw.com", "port": 443, "path": "/", "uuid": "678ac9f8901e3534847cced6edde5aee", "key": "702cc5c2c412a708a4663028b0d5997012d780a3a11887e7c6d0627ddc177a1b", "note": "\u9ed8\u8ba4", "backups": [ { "host": "nuihuw.top", "port": 443, "path": "/", "secure": true } ] }

The activity shares several operational characteristics with campaigns previously reported under SilverFox including DLL sideloading through a signed application, multi-stage payload delivery, persistence through Windows services and scheduled tasks, Microsoft Defender exclusions, process injection, and the use of a vulnerable driver to terminate security-product processes. The apparent targeting is also consistent with previously reported activity affecting victims in Southeast Asia, including Cambodia. References to zam64 and BootRepair.sys provide additional overlap with earlier SilverFox research by Cato Networks and Check Point Research , although neither driver was deployed in the analyzed sample; only ardrv.sys was confirmed in use.

These similarities are useful for clustering, but they are not enough to attribute the campaign directly to SilverFox. The techniques are not unique to one threat actor, and the current investigation did not identify shared infrastructure, a unique campaign marker, function-level code reuse, matching certificates, or another actor-specific link. The campaign also deploys SparkRAT rather than the ValleyRAT/Winos payload more commonly associated with publicly documented SilverFox activity. This difference does not rule out a relationship, since operators can change payloads, but it removes one of the stronger links used in attributions.

The SparkRAT configuration contains a Chinese-language value, and the malware targets several security products commonly used in Chinese-speaking environments. These characteristics are compatible with a Chinese-language development or deployment environment, but they do not independently establish the operators’ nationality or geographic location, which is the current challenge related to the attribution.

The observed characteristics may also reflect reused tooling or configuration tailored to the intended victim environment. We therefore track the activity as an unattributed cluster with possible Chinese-language development or deployment links and operational similarities to the broader SilverFox ecosystem. This assessment remains low confidence and may change if additional code, infrastructure, victimology, or other attributional evidence is identified.

The analyzed campaign uses a multi-stage execution chain with each component handling a specific part of the attack. An Inno Setup package creates a hidden staging directory, launches a signed Tencent executable, and relies on DLL sideloading to start the malicious loader. The loader then extracts encrypted stages from several PNG-formatted files and moves execution into vssvc.exe, ctfmon.exe, and svchost.exe.

Persistence and defense impairment are built into multiple stages. The malware creates both a service and a scheduled task named TaskHandler, monitors vssvc.exe so it can repeat the injection after a restart, attempts to patch AMSI and ETW, adds Microsoft Defender exclusions, and terminates selected security-product processes using a BYOVD technique by deploying ardrv.sys in kernel mode, and alternatively uses the TerminateProcess API in user mode.

The final embedded PE is identified as SparkRAT and was observed communicating with sx[.]nuihuw[.]com over port 443, with nuihuw[.]top:443 serving as a backup endpoint. Although the campaign shares several techniques with publicly reported SilverFox activity, the available evidence does not support direct attribution. No shared infrastructure, unique campaign marker, or confirmed code-level relationship with a known SilverFox sample has been identified. The activity is therefore tracked as an unattributed cluster with possible Chinese-language development or deployment links, assessed with low confidence.

This threat has been detected and blocked by Acronis EDR/XDR:

Cambodian_Government_Notice_on_COVID_19_Prevention_and_Control_July.z f7b9ab6c6d46b9b82c9c5a4deebf2f77ef1cbfffe2bf11c5c412f9f4f416d9ab

Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe 0a050e1d5338b936037f0928039c26893a553c3170b16b82bf75a9113b34a52f

ardrv.sys 7504887e1e195ad585cffa5b6a5034161a7cc49f351123d60def79302bdb8326

WfoY.qf 7ef1757e773270f5f0799797861290097a202dc1fe7a1eab13373d8a132da0d0

56360VK1ES8.yvap 0f0f06669c4bf4d222384b23766b93fb2f8a370047af50a8d5009564959f6171

BssBfeFFoA3A.nz 603247ade94f89f46d781b707fad7a73f959a7ea6553e1447753e52a2ea4b694

cnV.rb 14eae85f027a94dbd1814f0925c5ec541ba8dfe6a850ab4004cfc95d67a1516d

d7zzQhzRglBv.es 61a061293a2d872267a08ff66e57d3e01113fd0a395be6661960e69d15a7cca3

C2 Server sx.nuihuw.com:443

Backup C2 Server nuihuw.top:443

Other discovered archives: