CERT24Spark RAT Targets Cambodia and Abuses a Vulnerable OPSWAT Driver to Disable Security ToolsLoading data…
CERT24Threat Observatory
Period

Spark RAT Targets Cambodia and Abuses a Vulnerable OPSWAT Driver to Disable Security Tools

A campaign targeting individuals and organizations in Cambodia delivers the open-source, Go-based remote access trojan Spark RAT. The attack chains use compressed archives distributed through phishing emails, DLL sideloading, and the BYOVD technique to load the vulnerable OPSWAT AppRemover driver ardrv.sys and neutralize security software. Malicious artifacts identified by Acronis date from late June through early August 2026, but it is unclear whether the activity is ongoing.

← Back to intelligence

Spark RAT Targets Cambodia and Abuses a Vulnerable OPSWAT Driver to Disable Security Tools

A campaign targeting individuals and organizations in Cambodia delivers the open-source, Go-based remote access trojan Spark RAT. The attack chains use compressed archives distributed through phishing emails, DLL sideloading, and the BYOVD technique to load the vulnerable OPSWAT AppRemover driver ardrv.sys and neutralize security software. Malicious artifacts identified by Acronis date from late June through early August 2026, but it is unclear whether the activity is ongoing.