Cyber Campaign Targets Cambodia with Spark RAT via BYOVD Technique

A new cyber campaign has emerged, targeting individuals and organizations in Cambodia with the Spark RAT, an open-source remote access trojan. The attackers utilize a sophisticated multi-stage infection chain, employing a 'bring your own vulnerable driver' (BYOVD) technique that exploits a legitimate driver (ardrv.sys) linked to OPSWAT AppRemover to escalate privileges and disable security software. Victims are lured through phishing emails containing compressed archives with an Inno Setup executable, disguised as government notices, public health materials, and real estate documents. The attack chain incorporates anti-sandbox checks and attempts to disable security products like Microsoft Defender. While the campaign shows similarities to previous activities by the Silver Fox threat actor, definitive attribution remains unclear due to differences in payloads. The Spark RAT, written in Go, allows attackers to remotely control compromised devices. The presence of Chinese-language elements in the configuration hints at possible links to Chinese-speaking environments.

Key Points: • Spark RAT targets Cambodia using sophisticated phishing techniques. • Attackers exploit a vulnerable driver to escalate privileges and disable security tools. • The campaign shows similarities to past Silver Fox activities but lacks definitive attribution.