Spark RAT Vulnerability

Overview

A new campaign has emerged in Cambodia, delivering the open‑source Spark RAT through phishing emails and compressed archives. Researchers at Acronis Threat Research Unit (TRU) revealed that attackers are using the Bring Your Own Vulnerable Driver (BYOVD) technique to load a legitimate but flawed OPSWAT AppRemover driver (ardrv.sys), enabling privilege escalation and disabling security software.

Attack Chain

• Phishing lures: Government notices, public health materials, real estate documents, dental records, and promotional offers.
• Inno Setup installer: Triggers DLL sideloading via a signed Tencent executable.
• Driver exploitation: Deploys ardrv.sys (CVE‑2026‑36425) to terminate security processes.
• Anti‑sandbox checks: Timing‑based detection to evade analysis.
• Persistence setup: Windows service creation and scheduled tasks.
• Shellcode injection: Injects payload into vssvc.exe and later ctfmon.exe for execution.

Technical Highlights

• PNG‑based payloads: Multiple stages concealed in PNG files, decrypted at runtime.
• Privilege escalation: Exploits OPSWAT driver to disable Microsoft Defender, Huorong Internet Security, and Tencent PC Manager.
• Process monitoring: Ensures injected shellcode persists by re‑injecting if processes restart.
• Targeted evasion: Checks for Qihoo 360 processes before persistence setup.

Attribution Notes

• Silver Fox overlaps: Similarities in DLL sideloading, multi‑stage payload delivery, and targeting of Chinese security products.
• Key differences: Spark RAT is open‑source, unlike Silver Fox’s custom ValleyRAT payloads.
• Assessment: Activity tracked as an unattributed cluster with possible Chinese‑language development links, but attribution remains low confidence.

Defensive Guidance

Organizations should:

• Patch vulnerable drivers: Address CVE‑2026‑36425 and related flaws.
• Harden email defenses: Block phishing lures and compressed archive attachments.
• Monitor DLL sideloading: Watch for signed executables loading unexpected DLLs.
• Detect persistence: Investigate suspicious Windows services and scheduled tasks.
• Analyze PNG payloads: Flag unusual image files carrying embedded shellcode.

Expert in the Cloud Insight

The Spark RAT campaign demonstrates how attackers weaponize open‑source malware with BYOVD techniques to bypass defenses. By exploiting trusted drivers and layering payloads inside benign‑looking files, they achieve stealth, persistence, and control. The lesson is clear: driver vulnerabilities are as dangerous as application flaws, and defenders must treat them with equal urgency.