SparkRAT Ignites Cambodia via BYOVD Chain

Individuals and organizations across Cambodia are the intended targets of this campaign, which ultimately drops SparkRAT, an open-source Go-based remote access trojan. Delivery begins with phishing-style compressed archives sent to Cambodian recipients. Each archive contains an Inno Setup executable dressed up as a document, with lure themes tailored to local interest such as government advisories, COVID-19 announcements, dental examination records, real estate listings, and promotional offers. A representative sample carries the filename Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe. When the victim runs the installer, it silently drops staging directories under C:\Drivers along with a signed Tencent binary (F7u00ex.exe) and a malicious DLL (WfoY.qf). The signed executable is then abused to sideload the malicious DLL and kick off the infection chain via DLL sideloading.

Once sideloaded, the loader registers a Vectored Exception Handler and triggers a debugbreak() exception to jump into its main routine, an unusual control-flow trick that frustrates simple debuggers. It then runs a timing-based anti-sandbox check to filter out analysis environments that manipulate sleep delays. The loader parses encrypted shellcode hidden inside the IDAT chunks of four PNG files, decrypts each stage at runtime, and injects the payloads into legitimate Windows processes vssvc.exe, svchost.exe, and ctfmon.exe. Persistence is established in parallel through a Windows service named TaskHandler created via sc.exe and a scheduled task of the same name that runs F7u00ex.exe at system start under NT AUTHORITY\SYSTEM. The final embedded payload, reflectively loaded into ctfmon.exe, is identified as SparkRAT.

Rather than moving laterally, this campaign focuses on elevating privileges and dismantling on-host defenses. When not already running as SYSTEM, the loader searches for winlogon.exe, opens its process token, and impersonates the SYSTEM token to gain higher rights. It strips key privileges from any Huorong Internet Security tokens it finds and sets their integrity level to Untrusted, effectively blinding the endpoint product. In parallel, the shellcode patches AMSI and ETW to suppress script-scanning and telemetry, and adds Microsoft Defender registry exclusions for the staging paths and injected host processes. The most impactful step is a Bring Your Own Vulnerable Driver (BYOVD) routine that installs ardrv.sys, the OPSWAT AppRemover driver affected by CVE-2026-36425, and invokes its unprotected IOCTL 0x2420031 to terminate security processes from 360 Total Security, Huorong, Microsoft Defender, and Tencent PC Manager in kernel mode. A user-mode cleanup path that enables SeDebugPrivilege and calls TerminateProcess handles anything the kernel path misses.

With the environment stripped of defenses, the reflectively loaded SparkRAT payload takes over. It decrypts its embedded configuration using AES-CTR and validates the result against a stored MD5 hash before loading it into memory. The active configuration points to a primary command-and-control server at sx.nuihuw.com over port 443, with nuihuw.top:443 acting as a failover endpoint if the primary becomes unreachable. Each implant is identified by a unique UUID and communicates using a 256-bit key. Because SparkRAT is a full-featured Go-based RAT, operators gain interactive remote access to the compromised host, and file transfer, shell command execution, and follow-on data theft all run through this same encrypted HTTPS channel, blending exfiltration into normal-looking outbound traffic on port 443. The activity is tracked as an unattributed cluster with possible Chinese-language development or deployment links and loose operational overlaps with the broader Silver Fox ecosystem, held at low confidence.