Spark RAT Cambodia Campaign Abuses CVE-2026-36425 OPSWAT Driver for BYOVD Defense Evasion

The campaign unpacked between late June and early August 2026 used compressed archives containing Inno Setup executables themed around Cambodian government notices and real estate documents. Execution triggered DLL side-loading, a timing anti-sandbox check, and two PNG-embedded shellcode stages that verified SYSTEM privileges before selecting inject or persistence modes. The loader then deployed ardrv.sys to exploit CVE-2026-36425 and performed additional user-mode process termination against hard-coded security binaries. Acronis telemetry shows process checks for HipsTray.exe and Qihoo binaries, followed by AMSI and ETW patching plus scheduled-task persistence. The pattern mirrors earlier BYOVD abuse documented in 2024-2025 campaigns against Chinese and Southeast Asian endpoints, where attackers rotated vulnerable drivers faster than vendor blocklists. Independent code review of Spark RAT GitHub releases confirms the injected payloads match the described PNG decryption routines. The operation reveals a maturing toolkit that combines open-source RATs with commodity vulnerable drivers rather than custom kernel exploits. This lowers the barrier for mid-tier actors while increasing dwell time against signature-based EDR. Procurement records from Cambodian ministries show continued reliance on legacy endpoint products that remain exposed to the same driver class. Next indicators will likely include new lure themes tied to upcoming Cambodian elections or health campaigns, with possible expansion to Vietnamese and Lao targets if the same infrastructure persists beyond September 2026.