Affected Systems

Organizations and individuals in Cambodia. Campaign abuses vulnerable OPSWAT AppRemover driver (ardrv.sys, CVE-2026-36425) via BYOVD technique. Targets systems running Microsoft Defender, Huorong Internet Security, Tencent PC Manager, and Qihoo 360. Active timeframe: late June through early August 2026.

Exploitation Status

Active exploitation confirmed. Campaign observed delivering Spark RAT (open-source Go-based RAT) between late June and early August 2026. Exploits CVE-2026-36425 in OPSWAT AppRemover driver (ardrv.sys) to escalate privileges and terminate security processes. Ongoing campaign status unclear as of report date.

Business Impact

Attackers gain full remote control of compromised systems via Spark RAT. Multi-stage attack disables endpoint security products (Microsoft Defender, Huorong, Tencent PC Manager, Qihoo 360) using vulnerable driver exploitation. Establishes persistence through Windows services and scheduled tasks. Employs anti-sandbox checks and AMSI/ETW patching to evade detection. Possible links to Silver Fox threat actor ecosystem, though attribution remains low confidence.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Block or quarantine OPSWAT AppRemover driver ardrv.sys (vulnerable to CVE-2026-36425) across endpoints using EDR or application control policies
  • Hunt for Inno Setup executables delivered via phishing with Cambodian government, health, or real estate lures; inspect compressed archives containing signed Tencent executables used for DLL side-loading
  • Monitor for suspicious activity in vssvc.exe and ctfmon.exe processes, particularly shellcode injection patterns and unexpected child processes
  • Review Windows services and scheduled tasks for unauthorized persistence mechanisms created between late June and August 2026; check for references to ardrv.sys or DLL side-loading chains
  • Enable driver signature enforcement and block known vulnerable drivers via Windows Defender Application Control (WDAC) or similar controls; audit for TrueSight and Zemana Anti-Malware SDK drivers also referenced in BYOVD routines

---

# Geopolitical Context

Geopolitical Context

Cambodia has emerged as the target of a sophisticated cyber campaign deploying Spark RAT, an open-source remote access trojan, through phishing operations using diverse lures including government notices, public health materials, and real estate content. The campaign, active between late June and early August 2026, employs advanced techniques including bring-your-own-vulnerable-driver (BYOVD) methods to disable security software. The malware configuration contains Chinese-language values and targets security products commonly used in Chinese-speaking environments, suggesting possible Chinese-language development or deployment links. While the campaign exhibits operational similarities to the Silver Fox threat actor ecosystem—including targeting overlaps, DLL sideloading, multi-stage delivery, and specific focus on Huorong and Qihoo 360 security products—researchers assess attribution remains low confidence due to absence of shared infrastructure, code reuse, or matching certificates. The use of an open-source RAT rather than custom payloads like ValleyRAT further differentiates this activity from established Silver Fox patterns.

State Actor Alignment

No definitive state actor attribution has been established. Researchers track this as an unattributed cluster with possible Chinese-language development or deployment links based on linguistic artifacts and targeting of Chinese security products. Operational similarities to the Silver Fox threat actor ecosystem are noted, including targeting patterns and technical tradecraft, but key attribution indicators—shared infrastructure, function-level code reuse, and certificate matching—are absent. The deployment of open-source Spark RAT rather than custom tooling represents a significant departure from known Silver Fox campaigns. This assessment remains low confidence pending additional evidence.

Business Impacty pro region

The targeting of Cambodia reflects the country's position within Southeast Asian geopolitical dynamics and its complex relationships with regional powers. Cambodia's close political and economic ties with China, combined with its strategic location along critical maritime and land corridors, make it a focal point for intelligence collection activities. The broad targeting approach—using government, public health, and commercial lures—suggests intelligence gathering objectives rather than narrowly focused espionage. The campaign's sophistication, including BYOVD techniques exploiting CVE-2026-36425 in OPSWAT's AppRemover driver, demonstrates adversary adaptation to modern endpoint security defenses. For Southeast Asia broadly, this activity underscores persistent cyber threats facing ASEAN member states and the region's vulnerability to espionage campaigns potentially linked to major power competition.

Forecast

If this campaign represents an evolution in Silver Fox operations toward open-source tooling, similar activity may emerge targeting other Southeast Asian nations with comparable geopolitical profiles. If the Chinese-language indicators and security product targeting reflect state-aligned objectives, Cambodia's continued strategic importance to Beijing may sustain intelligence collection efforts in the near term. Organizations in Cambodia should anticipate continued phishing campaigns using localized lures and prepare for BYOVD techniques that bypass traditional endpoint protections. If additional infrastructure or code overlaps emerge linking this cluster to known threat actors, attribution confidence may increase and enable more targeted defensive measures. Regional security cooperation mechanisms within ASEAN may prove critical if this activity expands beyond Cambodia to neighboring states.