As reported by The Hacker News, a campaign targeting Cambodian individuals and organizations is delivering the open-source Spark RAT through a sophisticated multi-stage chain that abuses a vulnerable OPSWAT driver (ardrv.sys) to escalate privileges and disable endpoint security tools. Acronis Threat Research Unit attributed the activity to artifacts discovered between late June and early August 2026.

Threat Alert: As reported by The Hacker News, a campaign targeting Cambodian individuals and organizations is delivering the open-source Spark RAT through a sophisticated multi-stage chain that abuses a vulnerable OPSWAT driver (ardrv.sys) to escalate privileges and disable endpoint security tools.

Why This Matters

The convergence of two trends — open-source RAT frameworks and the BYOVD (Bring Your Own Vulnerable Driver) technique — represents a maturing threat landscape where capability that once required significant development resources is now accessible to mid-tier operators. Spark RAT being open-source and Go-based means it is cross-platform, actively maintained, and freely available. The OPSWAT AppRemover driver abuse for privilege escalation and security tool termination follows the well-documented pattern of BYOVD attacks that Microsoft's Vulnerable Driver Blocklist attempts to address.

The campaign's regional focus on Cambodia with localized lures — government notices, public health materials, real estate documents — indicates targeted social engineering rather than opportunistic spraying. This suggests the operators have regional knowledge and specific victim profiling capabilities.

Technical Analysis: The Kill Chain

The attack demonstrates several evasion techniques defenders should understand:

Technical Analysis: The Kill Chain
Initial Access: Phishing emails delivering compressed archives containing Inno Setup executables with diverse Cambodian-themed lures
DLL Side-Loading: A signed Tencent executable is abused to load malicious DLLs, leveraging legitimate code-signing certificates to bypass application control
Anti-Sandbox: Timing-based checks detect manipulated sleep delays common in analysis environments
Security Product Evasion: Active detection and privilege weakening of Huorong Internet Security (HipsTray.exe), indicating the threat actor anticipates Chinese security software on targets
BYOVD Escalation: The vulnerable ardrv.sys driver enables kernel-level access to terminate security tools
PNG Steganography: Shellcode concealed within PNG files for payload delivery, evading signature-based detection
Process Injection: Final payload injected into vssvc.exe (Volume Shadow Copy service), a legitimate Windows process

Who Is at Risk

Organizations and individuals in Southeast Asia — particularly Cambodia — are the primary targets. However, the techniques deployed (BYOVD, DLL side-loading, PNG steganography) are transferable. Any environment running OPSWAT AppRemover or lacking vulnerable driver blocklist enforcement is at elevated risk. Small-to-midsize organizations with limited EDR coverage are particularly exposed, as the attack specifically attempts to neutralize security tooling.

Broader Implications

The use of open-source RATs combined with BYOVD techniques signals that regional threat actors are achieving enterprise-grade capability without enterprise-grade investment. Defenders must assume that open-source offensive tooling will continue to lower the barrier to sophisticated attacks.

The targeting of Huorong Internet Security specifically suggests the operators expect Chinese-made security software on their victims — a strategic intelligence indicator about the expected target profile. This regional software targeting pattern can help defenders anticipate which tools threat actors expect to encounter.

Shield53 Recommendations

Immediate Actions

  • Enable Microsoft Vulnerable Driver Blocklist: Ensure the blocklist is active on all Windows endpoints via Windows Security settings or Group Policy. This would block the vulnerable ardrv.sys from loading.
  • Audit OPSWAT AppRemover: If deployed in your environment, remove or update the software. The vulnerable driver should not be present on production endpoints.
  • EDR Coverage: Ensure EDR solutions are deployed with tamper protection enabled. Tamper protection prevents privilege-based termination of security processes.
  • Email Gateway Controls: Block or quarantine compressed archives containing executables, particularly Inno Setup packages from external senders targeting Southeast Asian users.

Detection Opportunities

  • Monitor for vssvc.exe anomalous behavior: Network connections, child process spawning, or unusual memory allocations from the Volume Shadow Copy service
  • Alert on ardrv.sys loads: This driver should not appear on standard endpoints; its presence indicates potential BYOVD activity
  • Track DLL side-loading: Monitor signed Tencent executables loading unsigned or unexpected DLLs
  • PNG file analysis: Deploy tools capable of detecting embedded shellcode in image files, particularly in user temp directories

Strategic Defenses

  • Application Allow-Listing: WDAC or AppLocker policies should prevent unsigned executables and DLLs from running, breaking the side-loading chain
  • Privilege Management: Implement least-privilege models to limit the impact of successful privilege escalation attempts
  • Threat Intelligence Integration: Subscribe to feeds tracking regional campaigns targeting Southeast Asia for proactive indicator matching

The Spark RAT campaign underscores that open-source tooling combined with established techniques like BYOVD creates a credible threat to organizations with immature security postures. Defenders should prioritize vulnerable driver mitigation and EDR tamper protection as foundational controls against this class of attack.