Individuals and organizations across Cambodia have become targets of a new campaign delivering an open-source remote access trojan called Spark RAT, according to an analysis published Wednesday by the Acronis Threat Research Unit. Researchers Darrel Virtusio and Subhajeet Singha identified malicious artifacts between late June and early August 2026, though it's unclear whether the operation continues. The campaign uses diverse lures—from government notices to dental records—to reach a wide victim base.

The attack deploys a multi-stage infection chain that abuses a legitimate-but-vulnerable driver linked to OPSWAT AppRemover to gain elevated privileges and disable security software. Phishing emails distribute compressed archives holding an Inno Setup executable, with lures spanning Cambodian government announcements, public health materials, real estate documents, and promotional content. The installer triggers DLL side-loading via a signed Tencent executable, which then delivers interim payloads that deploy the vulnerable "ardrv.sys" driver before launching Spark RAT—a Go-based, cross-platform trojan enabling remote control of infected machines.

The DLL loader performs timing-based anti-sandbox checks to identify environments that alter sleep delays, terminating if elapsed time falls outside expected parameters. It also scans for processes tied to Huorong Internet Security, a Chinese endpoint product, and attempts to reduce the security software's privileges if detected. According to the researchers, "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims." The payload then decrypts shellcode hidden in a PNG file, verifying whether it runs with SYSTEM privileges to select one of two execution modes—inject mode or setup mode—with the latter establishing persistence through a Windows service before injecting shellcode into "vssvc.exe."

The operation shares tactical overlaps with the Silver Fox threat actor, including DLL sideloading, multi-stage delivery, and targeting of Huorong security processes. However, Acronis stopped short of definitive attribution, citing the absence of shared infrastructure, function-level code reuse, or matching certificates. Most notably, Silver Fox typically deploys ValleyRAT and custom payloads rather than open-source tools like Spark RAT. The report notes the malware "targets several security products commonly used in Chinese-speaking environments" and contains Chinese-language configuration values, leading researchers to track it as "an unattributed cluster with possible Chinese-language development or deployment links" and operational similarities to the broader Silver Fox ecosystem—an assessment that remains low confidence pending additional evidence. For organizations in the region, the campaign underscores the need for endpoint monitoring capable of detecting vulnerable driver abuse and multi-stage shellcode injection. As threat actors increasingly turn to open-source tooling, defenders may find attribution harder but detection patterns more widely shared across the security community.