Cambodia lures deploy SparkRAT in stealthy malware campaign

Acronis has identified a malware campaign that used Cambodia-themed lures to deploy SparkRAT and employed several defence-evasion techniques.

Researchers said the operation relied on a multi-stage infection chain combining DLL sideloading, process injection and encrypted payloads hidden in PNG image files. It also used a Bring Your Own Vulnerable Driver technique, in which attackers installed a legitimate but flawed driver to interfere with security tools before deploying the final payload.

The campaign was assessed as focused on Cambodia because of the names and themes of the archive files used as lures. Those files referenced Cambodian government notices, public health announcements, dental records, real estate documents and promotional offers, suggesting an effort to appeal to a broad range of recipients.

The infection began with an Inno Setup executable disguised as a document. Once opened, the installer created hidden directories on the victim machine, dropped several components and used a signed Tencent binary to sideload a malicious DLL.

The malware then carried out anti-analysis checks and token manipulation before extracting encrypted data from PNG files. The files served as containers for later stages, which were decrypted at run time and injected into legitimate Windows processes including vssvc.exe, ctfmon.exe and svchost.exe.

The final payload was identified as SparkRAT, an open-source remote access trojan written in Go. Researchers observed the malware communicating with a command-and-control server over port 443, while a second domain appeared to serve as a backup route if the primary server became unavailable.

Driver abuse

A key element of the activity was the use of ardrv.sys, a driver linked to OPSWAT AppRemover. According to the analysis, the version recovered during the investigation was affected by CVE-2026-36425, a flaw that lets local users submit process termination requests without proper privilege checks.

By loading that driver, the attackers were able to terminate security-related processes at kernel level. The malware used this access to target products from Microsoft Defender, Huorong Internet Security, Tencent PC Manager and 360 Total Security.

The code also set Microsoft Defender exclusions for selected processes and directories, including VSSVC.exe, ctfmon.exe, C:\Drivers and C:\Windows\System32. In a separate user-mode step, another payload enabled SeDebugPrivilege and used TerminateProcess to shut down additional security processes.

Persistence was built into several stages of the intrusion. The malware created both a Windows service and a scheduled task named TaskHandler, allowing it to survive reboots and continue launching its components after restart.

One stage monitored the injected vssvc.exe process and reinjected shellcode if the process terminated or restarted under a new process ID. That behaviour, combined with the use of trusted Windows processes, was intended to reduce the chances of detection while maintaining remote access.

Attribution limits

The operation shared some traits with activity previously associated with SilverFox, including DLL sideloading through a signed application, layered payload delivery, persistence through services and scheduled tasks, Defender exclusions and the use of vulnerable drivers to disable security products.

Even so, the researchers stopped short of assigning the campaign to that group. The analysis found no shared infrastructure, no confirmed code-level overlap and no actor-specific marker to support a stronger conclusion.

Instead, the report described the activity as an unattributed cluster with possible Chinese-language development or deployment links, assessed with low confidence. That view was based partly on a Chinese-language value found in the SparkRAT configuration and the malware's focus on security products commonly used in Chinese-speaking environments.

Wider pattern

The findings point to a broader shift in attacker behaviour away from simple delivery tactics and towards stealth, persistence and the deliberate weakening of endpoint defences. Security teams in Australia and elsewhere have been tracking a rise in attacks that abuse legitimate software, signed binaries and trusted system components to blend in with normal activity.

In this case, the tradecraft mattered as much as the apparent targeting. The use of a signed Tencent executable, image files as payload containers, repeated process injection and a vulnerable driver gave the attackers multiple ways to remain active even if one part of the chain was interrupted.

The malware also attempted to patch AMSI- and ETW-related functions before carrying out other tasks. Those mechanisms are commonly used by defenders and security products to inspect script activity and collect telemetry, making them frequent targets for attackers seeking to reduce visibility.

The campaign was observed in samples collected over several weeks, though the available evidence was not enough to determine whether it remained active. The final embedded payload was SparkRAT, which communicated with sx.nuihuw.com over port 443, with nuihuw.top listed as a backup endpoint.