Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Back Thehackernews

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Thehackernews •[email protected] (The Hacker News) • August 27, 2026

Share: View original

AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.

AI is helping teams ship code 10–50× faster. This session shows how to keep security from falling behind.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyber Campaign Targets Cambodia with Spark RAT via BYOVD Technique A new cyber campaign has emerged, targeting individuals and organizations in Cambodia with the Spark RAT, an open-source remote access trojan. The attackers utilize a sophisticated multi-stage infection chain, employing a 'bring your own vulnerable driver' (BYOVD) technique that exploits a legitimate driver (ardrv.sys) linked to OPSWAT AppRemover to escalate privileges and disable security software. Victims are lured through phishing emails containing compressed archives with an Inno Setup executable, disguised as government notices, public health materials, and real estate documents. The attack chain incorporates anti-sandbox checks and attempts to disable security products like Microsoft Defender. While the campaign shows similarities to previous activities by the Silver Fox threat actor, definitive attribution remains unclear due to differences in payloads. The Spark RAT, written in Go, allows attackers to remotely control compromised devices. The presence of Chinese-language elements in the configuration hints at possible links to Chinese-speaking environments. 2 sources 69

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

T1562.001 - Disable Or Modify Tools

Tools (1)