Skip to navigation

Threat reportMalwareTL-2026-2182

Spark RAT Campaign Targets Cambodia via BYOVD Abuse of Vulnerable OPSWAT AppRemover Driver (CVE-2026-36425)

highACTIVE

An unattributed threat cluster targeted individuals and organizations in Cambodia between late June and early August 2026 with phishing emails delivering Inno Setup installers that side-load malware through a signed Tencent binary, decrypt PNG-embedded shellcode, and abuse a vulnerable OPSWAT AppRemover driver (ardrv.sys, CVE-2026-36425) via BYOVD to terminate Microsoft Defender, Huorong Internet Security, Tencent PC Manager and 360 Security before deploying the open-source Spark RAT.

Key facts for Spark RAT Cambodia BYOVD

IdentifiersTL-2026-2182, CVE-2026-36425
SeverityHIGH
CVSS6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
First disclosed
Exploitation statusExploited in the wild
EPSSCVE-2026-36425: 0.3% (31.5th percentile)
Affected productsOPSWAT AppRemover Driver (ardrv.sys)
Weaknesses (CWE)CWE-269
MalwareSparkRAT
MITRE ATT&CK techniquesT1008 Fallback Channels, T1027 Obfuscated Files or Information, T1036.005 Masquerading, T1053 Scheduled Task/Job, T1055 Process Injection, T1057 Process Discovery, T1059.003 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1112 Modify Registry, T1134.001 Access Token Manipulation, T1140 Deobfuscate/Decode Files or Information, T1204.002 User Execution and 9 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, health, realestate, generalpublic
Target regionsSoutheast Asia, cambodia
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Spark RAT Cambodia BYOVD

As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2182 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Spark RAT Campaign — BYOVD ardrv.sys Abuse, Security-Tool Termination & TaskHandler Persistence (SPL)

Detects the post-exploitation stage of the campaign: loading of the vulnerable OPSWAT AppRemover driver ardrv.sys (CVE-2026-36425) to abuse IOCTL 0x2420031 for unauthenticated termination of Microsoft Defender, Huorong, Tencent PC Manager and 360 Security; AMSI/ETW patching and Defender-exclusion additions; TaskHandler service/scheduled-task persistence; and process injection into vssvc.exe, ctfmon.exe, and svchost.exe.

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=6 (ImageLoaded="*\\ardrv.sys" OR Hashes="*07C5209BF83065FE760F4FEE4ED2308B0C523671F68CA73A3854C2C8C28C054*" OR Hashes="*826C6D2E3D80F2D43F7977F998525AD3*" OR Hashes="*2248347B2EC49F07268A44816EBB6265677093EC277F825DE1A76700AB25E3BC*"))
OR
(EventCode=1 (CommandLine="*sc*create*TaskHandler*" OR CommandLine="*schtasks*/create*TaskHandler*" OR CommandLine="*Add-MpPreference*-ExclusionPath*" OR CommandLine="*Set-MpPreference*-DisableRealtimeMonitoring*"))
OR
(EventCode=8 (TargetImage="*vssvc.exe" OR TargetImage="*ctfmon.exe" OR TargetImage="*svchost.exe") SourceImage!="C:\\Windows\\*")
OR
(EventCode=13 TargetObject="*\\SYSTEM\\CurrentControlSet\\Services\\ardrv*")
| eval technique=case(
    EventCode=6,"T1543.003_driver_load",
    match(CommandLine,"TaskHandler"),"T1543.003_T1053.005_persistence",
    match(CommandLine,"MpPreference"),"T1562.001_defender_tamper",
    EventCode=8,"T1055_process_injection",
    EventCode=13,"T1112_registry_modify")
| table _time, host, EventCode, Image, ImageLoaded, TargetImage, SourceImage, CommandLine, TargetObject, technique

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DriverLoad" and (FolderPath has "ardrv.sys" or SHA256 in~ ("07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c054", "2248347b2ec49f07268a44816ebb6265677093ec277f825de1a76700ab25e3bc"))
| project Timestamp, DeviceName, EventType="byovd_driver_load", ActionType, FolderPath, SHA256, InitiatingProcessAccountName
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has "TaskHandler" and ProcessCommandLine has_any ("sc create", "sc.exe create", "schtasks", "/create")
    | project Timestamp, DeviceName, EventType="taskhandler_persistence", ActionType="ProcessCreated", FolderPath=ProcessCommandLine, SHA256="", InitiatingProcessAccountName=AccountName
  )
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference -DisableRealtimeMonitoring", "-ExclusionPath")
    | project Timestamp, DeviceName, EventType="defender_tamper", ActionType="ProcessCreated", FolderPath=ProcessCommandLine, SHA256="", InitiatingProcessAccountName=AccountName
  )
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("vssvc.exe", "ctfmon.exe", "svchost.exe")
    | where InitiatingProcessFileName !in~ ("services.exe", "wininit.exe", "svchost.exe")
    | project Timestamp, DeviceName, EventType="process_injection_target", ActionType="ProcessAccess", FolderPath=FileName, SHA256="", InitiatingProcessAccountName=AccountName
  )
| order by Timestamp asc

Sigma

title: BYOVD — Vulnerable OPSWAT AppRemover Driver (ardrv.sys) Loaded (CVE-2026-36425)
id: 3b7e5f21-9a4c-4d8e-b1f6-2c8d5a7e6f13
status: experimental
description: Detects the vulnerable OPSWAT AppRemover kernel driver ardrv.sys being loaded, which the Cambodia-targeted Spark RAT campaign abuses via the improper-access-control flaw CVE-2026-36425 (IOCTL 0x2420031) to unauthenticatedly terminate Microsoft Defender, Huorong, Tencent PC Manager, and 360 Security processes (BYOVD).
references:
    - https://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279/
    - https://github.com/redteamfortress/CVE-2026-36425
    - https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/28
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1562.001
    - attack.t1543.003
    - attack.t1068
    - cve.2026.36425
    - attack.tool.spark_rat
logsource:
    category: driver_load
    product: windows
detection:
    selection_name:
        ImageLoaded|endswith: '\ardrv.sys'
    selection_hash:
        Hashes|contains:
            - '07C5209BF83065FE760F4FEE4ED2308B0C523671F68CA73A3854C2C8C28C054'
            - '826C6D2E3D80F2D43F7977F998525AD3'
            - '7340EAE2CCF3D57AC3AE271C9983996D8AE7FDE0'
            - '2248347B2EC49F07268A44816EBB6265677093EC277F825DE1A76700AB25E3BC'
    condition: selection_name or selection_hash
falsepositives:
    - Legitimate use of OPSWAT AppRemover (OESIS Framework) for authorized security-software removal on a patched driver version
level: critical

Known false positives:

  • Legitimate authorized use of OPSWAT AppRemover (OESIS Framework) on a patched driver for security-software removal
  • EDR/AV vendor self-uninstall or migration workflows using sc create / schtasks that do not reference TaskHandler

Tuning notes: Correlate ardrv.sys load events with subsequent Defender/Huorong/Tencent PC Manager/360 process terminations within a short time window to raise confidence before triggering auto-response; adjust the TaskHandler literal if the actor rotates persistence artifact names in future waves.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Spark RAT Campaign — Tencent-Signed Binary Loading Anomalous DLL (KQL) · unlock with TL Creds
  • Spark RAT Campaign — BYOVD ardrv.sys Abuse, Security-Tool Termination & TaskHandler Persistence (KQL) · unlock with TL Creds
  • Spark RAT Campaign — WebSocket C2 to [indicator] / [indicator] (KQL) · unlock with TL Creds
  • Spark RAT Campaign — Tencent-Signed Binary Loading Anomalous DLL (Sigma) · unlock with TL Creds
  • Spark RAT Campaign — BYOVD ardrv.sys Abuse, Security-Tool Termination & TaskHandler Persistence (Sigma) · unlock with TL Creds
  • Spark RAT Campaign — WebSocket C2 to [indicator] / [indicator] (Sigma) · unlock with TL Creds
  • Spark RAT Campaign — Tencent-Signed Binary Loading Anomalous DLL (SPL) · unlock with TL Creds
  • Spark RAT Campaign — WebSocket C2 to [indicator] / [indicator] (SPL) · unlock with TL Creds

Indicators of compromise for Spark RAT Cambodia BYOVD

As of 2026-10-20, Threadlinqs Intelligence tracks 36 indicators of compromise for TL-2026-2182.

Sample indicators (3 of 36)

  • Domain: sx[.]nuihuw[.]com
  • File hash: 0a050e1d5338b936037f0928039c26893a553c3170b16b82bf75a9113b34a52f
  • Domain: nuihuw[.]top

Defanged, TLP:CLEAR. Full set of 36 indicators: unlock with TL Creds.

36 indicators of compromise · unlock with TL Creds. Compare plans

How Spark RAT Cambodia BYOVD works

Acronis's Threat Research Unit (TRU) identified malicious artifacts between late June and early August 2026 belonging to a multi-stage infection chain aimed at Cambodian individuals and organizations. Victims receive phishing emails carrying compressed archives with an Inno Setup installer disguised behind localized lures such as "Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe", along with public-health, dental-record, real-estate and promotional-offer themes. Running the installer triggers a DLL side-loading chain in which the signed Tencent executable F7u00ex.exe loads the malicious DLL WfoY.qf. The loader performs timing-based anti-sandbox checks and process enumeration for installed security software, then decrypts shellcode embedded inside PNG payload containers (BssBfeFFoA3A.nz, d7zzQhzRglBv.es, cnV.rb, 56360VK1ES8.yvap) to run a second-stage payload.

The second stage checks for SYSTEM privileges by accessing winlogon.exe's token for impersonation. If elevated, it loads the legitimately signed but vulnerable OPSWAT AppRemover kernel driver ardrv.sys and abuses CVE-2026-36425 — an improper-access-control flaw in IOCTL handler 0x2420031 that lets any local caller submit unauthenticated process-termination requests via \\.\ardrv — in a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique to kill Microsoft Defender, Huorong Internet Security, Tencent PC Manager and 360 Security processes, patch AMSI and ETW, and add Defender exclusions. The malware then injects shellcode into vssvc.exe, ctfmon.exe and svchost.exe and establishes persistence via a Windows service and scheduled task both named TaskHandler. If privileges are not elevated, the malware falls back directly to establishing the same service/scheduled-task persistence without the driver-abuse step.

The final payload is Spark RAT, an open-source, Go-based, cross-platform remote access trojan (github.com/XZB-1248/Spark) that communicates with its operators over WebSocket. Observed C2 infrastructure is sx.nuihuw.com:443 (primary) and nuihuw.top:443 (backup). Acronis assesses low-confidence tactical overlap with the Chinese-speaking Silver Fox syndicate — based on shared targeting of Huorong processes, DLL side-loading through signed applications, multi-stage delivery, and Defender-exclusion tradecraft — but found no shared infrastructure, certificates, or code reuse, and tracks the cluster as unattributed with possible Chinese-language development or deployment links.

MITRE ATT&CK techniques by tactic:

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1219 Remote Access Tools; T1571 Non-Standard Port

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1562.006 Impair Defenses; T1574 Hijack Execution Flow

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process

Discovery

T1057 Process Discovery; T1518.001 Software Discovery

Execution

T1059.003 Command and Scripting Interpreter; T1204.002 User Execution

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Privilege Escalation

T1134.001 Access Token Manipulation

Initial Access

T1566 Phishing

Remediation for Spark RAT Cambodia BYOVD

Patches

  • Update OPSWAT AppRemover Driver to a version newer than v2017.10.02.1551 (CVE-2026-36425)

Immediate actions

  • Add ardrv.sys (SHA256 07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541 and variants) to Microsoft's vulnerable driver blocklist / WDAC-HVCI policy
  • Block outbound network connections to sx.nuihuw.com and nuihuw.top on port 443
  • Hunt for a service or scheduled task named TaskHandler created via sc create / schtasks /create
  • Alert on unsigned or anomalous DLLs (e.g. WfoY.qf) loaded by Tencent-signed executables (DLL side-loading)
  • Monitor for process injection into vssvc.exe, ctfmon.exe, and svchost.exe

Workarounds

  • Enforce Microsoft's vulnerable driver blocklist (HVCI) to prevent ardrv.sys from loading
  • Restrict device object access to \\.\ardrv to authorized/administrative accounts only

Longer-term hardening

  • Update or remove OPSWAT AppRemover (ardrv.sys) to a version newer than v2017.10.02.1551
  • Deploy EDR with kernel driver load monitoring and BYOVD-specific detection
  • Restrict local access to raw kernel device objects such as \\.\ardrv via ACL hardening
  • Deliver region-specific phishing awareness training referencing government/health/real-estate themed lures used against Cambodian targets

Affected and fixed versions

  • OPSWAT — AppRemover Driver (ardrv.sys)
    Vulnerable versions: v2017.10.02.1551 and earlier
    Fixed in: newer than v2017.10.02.1551

Timeline of Spark RAT Cambodia BYOVD

Last updated · revalidated 1× · latest source

  • CVE request for the OPSWAT AppRemover ardrv.sys improper access control flaw submitted by researcher Jehad Abudagga
  • CVE-2026-36425 formally assigned
  • OPSWAT publishes its security update for the legacy AppRemover driver ardrv.sys, CVE-2026-36425 (IOCTL 0x2420031 lets any local user terminate arbitrary processes).
  • OPSWAT releases the fixed OESIS Framework (June 25, 2026 release) and MetaDefender Endpoint 7.6.2606.1036, replacing ardrv.sys with libwasys.sys.
  • Acronis TRU observes the first malicious artifacts of the Cambodia-targeted campaign (late June 2026)
  • Phishing lure "locked-ioc-2" distributed, dated to this campaign wave
  • Public advisory and proof-of-concept for CVE-2026-36425 published on GitHub (redteamfortress/CVE-2026-36425)
  • Acronis TRU's observed campaign artifacts end (early August 2026)
  • The Hacker News publishes coverage summarizing the Acronis TRU findings
  • Acronis Threat Research Unit publishes "Cambodia-focused cluster uses multistage infection chain with localized lures"
  • SentinelOne includes the campaign in its "Good, the Bad and the Ugly in Cybersecurity – Week 35" roundup
  • Per OPSWAT, the Microsoft vulnerable driver blocklist entry covering the legacy ardrv.sys takes effect.

Update history

Sources cited for Spark RAT Cambodia BYOVD

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats