# Spark RAT Campaign Targets Cambodia via BYOVD Abuse of Vulnerable OPSWAT AppRemover Driver (CVE-2026-36425)

> An unattributed threat cluster targeted individuals and organizations in Cambodia between late June and early August 2026 with phishing emails delivering Inno Setup installers that side-load malware through a signed Tencent binary, decrypt PNG-embedded shellcode, and abuse a vulnerable OPSWAT AppRemover driver (ardrv.sys, CVE-2026-36425) via BYOVD to terminate Microsoft Defender, Huorong Internet Security, Tencent PC Manager and 360 Security before deploying the open-source Spark RAT.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-10-20T03:21:33.791Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2182
- **ID:** TL-2026-2182
- **Severity:** HIGH (CVSS 6.5)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 36 (3 shown free below)
- **CVEs:** CVE-2026-36425

## Description

Acronis's Threat Research Unit (TRU) identified malicious artifacts between late June and early August 2026 belonging to a multi-stage infection chain aimed at Cambodian individuals and organizations. Victims receive phishing emails carrying compressed archives with an Inno Setup installer disguised behind localized lures such as "Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe", along with public-health, dental-record, real-estate and promotional-offer themes. Running the installer triggers a DLL side-loading chain in which the signed Tencent executable F7u00ex.exe loads the malicious DLL WfoY.qf. The loader performs timing-based anti-sandbox checks and process enumeration for installed security software, then decrypts shellcode embedded inside PNG payload containers (BssBfeFFoA3A.nz, d7zzQhzRglBv.es, cnV.rb, 56360VK1ES8.yvap) to run a second-stage payload.

The second stage checks for SYSTEM privileges by accessing winlogon.exe's token for impersonation. If elevated, it loads the legitimately signed but vulnerable OPSWAT AppRemover kernel driver ardrv.sys and abuses CVE-2026-36425 — an improper-access-control flaw in IOCTL handler 0x2420031 that lets any local caller submit unauthenticated process-termination requests via \\.\ardrv — in a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique to kill Microsoft Defender, Huorong Internet Security, Tencent PC Manager and 360 Security processes, patch AMSI and ETW, and add Defender exclusions. The malware then injects shellcode into vssvc.exe, ctfmon.exe and svchost.exe and establishes persistence via a Windows service and scheduled task both named TaskHandler. If privileges are not elevated, the malware falls back directly to establishing the same service/scheduled-task persistence without the driver-abuse step.

The final payload is Spark RAT, an open-source, Go-based, cross-platform remote access trojan (github.com/XZB-1248/Spark) that communicates with its operators over WebSocket. Observed C2 infrastructure is sx.nuihuw.com:443 (primary) and nuihuw.top:443 (backup). Acronis assesses low-confidence tactical overlap with the Chinese-speaking Silver Fox syndicate — based on shared targeting of Huorong processes, DLL side-loading through signed applications, multi-stage delivery, and Defender-exclusion tradecraft — but found no shared infrastructure, certificates, or code reuse, and tracks the cluster as unattributed with possible Chinese-language development or deployment links.

## MITRE ATT&CK

- T1566 Phishing
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1497 Virtualization/Sandbox Evasion
- T1057 Process Discovery
- T1071 Application Layer Protocol
- T1204.002 User Execution
- T1059.003 Command and Scripting Interpreter
- T1134.001 Access Token Manipulation
- T1036.005 Masquerading
- T1562.006 Impair Defenses
- T1518.001 Software Discovery
- T1571 Non-Standard Port
- T1008 Fallback Channels
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Spark RAT Campaign — BYOVD ardrv.sys Abuse, Security-Tool Termination & TaskHandler Persistence (SPL)** (`TL-2026-2182-SPL-002`)

Detects the post-exploitation stage of the campaign: loading of the vulnerable OPSWAT AppRemover driver ardrv.sys (CVE-2026-36425) to abuse IOCTL 0x2420031 for unauthenticated termination of Microsoft Defender, Huorong, Tencent PC Manager and 360 Security; AMSI/ETW patching and Defender-exclusion additions; TaskHandler service/scheduled-task persistence; and process injection into vssvc.exe, ctfmon.exe, and svchost.exe.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1562.001, T1112, T1543.003, T1053.005, T1055, T1057, T1497.003
- **Data sources:** sysmon, windows_security, microsoft_defender_atp
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=6 (ImageLoaded="*\\ardrv.sys" OR Hashes="*07C5209BF83065FE760F4FEE4ED2308B0C523671F68CA73A3854C2C8C28C054*" OR Hashes="*826C6D2E3D80F2D43F7977F998525AD3*" OR Hashes="*2248347B2EC49F07268A44816EBB6265677093EC277F825DE1A76700AB25E3BC*"))
OR
(EventCode=1 (CommandLine="*sc*create*TaskHandler*" OR CommandLine="*schtasks*/create*TaskHandler*" OR CommandLine="*Add-MpPreference*-ExclusionPath*" OR CommandLine="*Set-MpPreference*-DisableRealtimeMonitoring*"))
OR
(EventCode=8 (TargetImage="*vssvc.exe" OR TargetImage="*ctfmon.exe" OR TargetImage="*svchost.exe") SourceImage!="C:\\Windows\\*")
OR
(EventCode=13 TargetObject="*\\SYSTEM\\CurrentControlSet\\Services\\ardrv*")
| eval technique=case(
    EventCode=6,"T1543.003_driver_load",
    match(CommandLine,"TaskHandler"),"T1543.003_T1053.005_persistence",
    match(CommandLine,"MpPreference"),"T1562.001_defender_tamper",
    EventCode=8,"T1055_process_injection",
    EventCode=13,"T1112_registry_modify")
| table _time, host, EventCode, Image, ImageLoaded, TargetImage, SourceImage, CommandLine, TargetObject, technique
```

### Microsoft KQL

```kql
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DriverLoad" and (FolderPath has "ardrv.sys" or SHA256 in~ ("07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c054", "2248347b2ec49f07268a44816ebb6265677093ec277f825de1a76700ab25e3bc"))
| project Timestamp, DeviceName, EventType="byovd_driver_load", ActionType, FolderPath, SHA256, InitiatingProcessAccountName
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has "TaskHandler" and ProcessCommandLine has_any ("sc create", "sc.exe create", "schtasks", "/create")
    | project Timestamp, DeviceName, EventType="taskhandler_persistence", ActionType="ProcessCreated", FolderPath=ProcessCommandLine, SHA256="", InitiatingProcessAccountName=AccountName
  )
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference -DisableRealtimeMonitoring", "-ExclusionPath")
    | project Timestamp, DeviceName, EventType="defender_tamper", ActionType="ProcessCreated", FolderPath=ProcessCommandLine, SHA256="", InitiatingProcessAccountName=AccountName
  )
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("vssvc.exe", "ctfmon.exe", "svchost.exe")
    | where InitiatingProcessFileName !in~ ("services.exe", "wininit.exe", "svchost.exe")
    | project Timestamp, DeviceName, EventType="process_injection_target", ActionType="ProcessAccess", FolderPath=FileName, SHA256="", InitiatingProcessAccountName=AccountName
  )
| order by Timestamp asc
```

### Sigma

```yaml
title: BYOVD — Vulnerable OPSWAT AppRemover Driver (ardrv.sys) Loaded (CVE-2026-36425)
id: 3b7e5f21-9a4c-4d8e-b1f6-2c8d5a7e6f13
status: experimental
description: Detects the vulnerable OPSWAT AppRemover kernel driver ardrv.sys being loaded, which the Cambodia-targeted Spark RAT campaign abuses via the improper-access-control flaw CVE-2026-36425 (IOCTL 0x2420031) to unauthenticatedly terminate Microsoft Defender, Huorong, Tencent PC Manager, and 360 Security processes (BYOVD).
references:
    - https://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279/
    - https://github.com/redteamfortress/CVE-2026-36425
    - https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/28
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1562.001
    - attack.t1543.003
    - attack.t1068
    - cve.2026.36425
    - attack.tool.spark_rat
logsource:
    category: driver_load
    product: windows
detection:
    selection_name:
        ImageLoaded|endswith: '\ardrv.sys'
    selection_hash:
        Hashes|contains:
            - '07C5209BF83065FE760F4FEE4ED2308B0C523671F68CA73A3854C2C8C28C054'
            - '826C6D2E3D80F2D43F7977F998525AD3'
            - '7340EAE2CCF3D57AC3AE271C9983996D8AE7FDE0'
            - '2248347B2EC49F07268A44816EBB6265677093EC277F825DE1A76700AB25E3BC'
    condition: selection_name or selection_hash
falsepositives:
    - Legitimate use of OPSWAT AppRemover (OESIS Framework) for authorized security-software removal on a patched driver version
level: critical
```

**Known false positives:**

- Legitimate authorized use of OPSWAT AppRemover (OESIS Framework) on a patched driver for security-software removal
- EDR/AV vendor self-uninstall or migration workflows using sc create / schtasks that do not reference TaskHandler

**Tuning notes:** Correlate ardrv.sys load events with subsequent Defender/Huorong/Tencent PC Manager/360 process terminations within a short time window to raise confidence before triggering auto-response; adjust the TaskHandler literal if the actor rotates persistence artifact names in future waves.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Spark RAT Campaign — Tencent-Signed Binary Loading Anomalous DLL (KQL) (locked: unlock with TL Creds)
- Spark RAT Campaign — BYOVD ardrv.sys Abuse, Security-Tool Termination & TaskHandler Persistence (KQL) (locked: unlock with TL Creds)
- Spark RAT Campaign — WebSocket C2 to [indicator] / [indicator] (KQL) (locked: unlock with TL Creds)
- Spark RAT Campaign — Tencent-Signed Binary Loading Anomalous DLL (Sigma) (locked: unlock with TL Creds)
- Spark RAT Campaign — BYOVD ardrv.sys Abuse, Security-Tool Termination & TaskHandler Persistence (Sigma) (locked: unlock with TL Creds)
- Spark RAT Campaign — WebSocket C2 to [indicator] / [indicator] (Sigma) (locked: unlock with TL Creds)
- Spark RAT Campaign — Tencent-Signed Binary Loading Anomalous DLL (SPL) (locked: unlock with TL Creds)
- Spark RAT Campaign — WebSocket C2 to [indicator] / [indicator] (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 36)

Defanged, TLP:CLEAR.

- Domain: `sx[.]nuihuw[.]com`
- File hash: `0a050e1d5338b936037f0928039c26893a553c3170b16b82bf75a9113b34a52f`
- Domain: `nuihuw[.]top`

Full set of 36 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools](https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html)
- [The Good, the Bad and the Ugly in Cybersecurity – Week 35](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-35-8/)
- [Cambodia-focused cluster uses multistage infection chain with localized lures](https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/)
- [Cambodia-focused cluster uses multistage infection chain with localized lures (mirror)](https://www.hendryadrian.com/cambodia-focused-cluster-uses-multistage-infection-chain-with-localized-lures/)
- [CVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory](https://github.com/redteamfortress/CVE-2026-36425)
- [NVD - CVE-2026-36425](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-36425)
- [OPSWAT AppRemover Driver (ardrv.sys) - LOLDrivers](https://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279/)
- [Introducing CVE-2026-36425 | OPSWAT EDR Terminator](https://medium.com/@jehadbudagga/introducing-cve-2026-36425-opswat-edr-terminator-32e50943abe7)
- [XZB-1248/Spark - open-source cross-platform RAT (GitHub)](https://github.com/XZB-1248/Spark)
- [OPSWAT OESIS Framework - Application Removal](https://www.opswat.com/products/oesis-framework/application-removal)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2182