Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT.
"The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics," Acronis Threat Research Unit (TRU) researchers Darrel Virtusio and Subhajeet Singha said in an analysis published Wednesday.
The multi-stage attack is notable for employing the bring your own vulnerable driver (BYOVD) technique to load a legitimate-but-vulnerable driver associated with OPSWAT AppRemover ("ardrv.sys") to escalate privileges and neutralize security software.
Attack chains likely make use of targeting phishing emails to distribute compressed archives containing an Inno Setup executable and trick recipients into running it using wide-ranging lures, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers.
Acronis said it discovered a number of malicious artifacts between late June through early August 2026, although it's unclear if the campaign remains ongoing.
