The Attack: Multi-Stage Delivery, BYOVD, and Persistence
A recent campaign targeting individuals and organizations in Cambodia demonstrates the multi-stage complexity of modern malware delivery. Researchers at Acronis identified attacks using phishing emails with diverse lures — Cambodian government notices, public health announcements, dental records, real estate documents, and promotional offers — to distribute compressed archives containing Inno Setup executables.
When a recipient runs the installer, it triggers a DLL sideloading chain using a signed Tencent executable. The DLL loader performs anti-sandbox checks and searches for Huorong Internet Security processes to weaken their privileges. It then decrypts shellcode hidden in PNG files and executes a second-stage payload.
The attack proceeds through two execution modes depending on privilege level. In setup mode, it establishes persistence via Windows services and scheduled tasks. In inject mode, it injects shellcode into vssvc.exe and monitors the process to re-inject if terminated.
The payload patches AMSI and ETW, installs a vulnerable OPSWAT AppRemover driver (ardrv.sys, CVE-2026-36425) to terminate security processes including Microsoft Defender, Huorong, and Tencent PC Manager, performs user-mode termination of additional security tools, and finally injects Spark RAT — an open-source Go-based remote access trojan — into ctfmon.exe.
The campaign shows operational similarities to the Silver Fox threat actor ecosystem, including DLL sideloading through signed applications, multi-stage payload delivery, and targeting of Chinese security products, though attribution remains low confidence.
Why Traditional Defenses Struggle
This attack chain defeats signature-based detection at multiple points. The phishing lures change constantly — government notices, health materials, real estate documents — making static email filtering unreliable. The Inno Setup installer is a legitimate tool, often signed. The DLL sideloading abuses a signed Tencent executable. The payloads hide in PNG files as encrypted shellcode. The BYOVD technique uses a legitimate driver with a known vulnerability to disable endpoint security before the final payload runs.
By the time the Spark RAT executes, the attack has already disabled or evaded most endpoint defenses. Detection at that stage means the scumbag already has remote access.
The Upstream Intervention: Block Payload Delivery
Every stage of this attack requires writing files to the Windows file system. The phishing email delivers a compressed archive. The victim extracts and runs the Inno Setup installer. That installer writes the signed Tencent executable, the malicious DLL, the PNG files containing encrypted payloads, and the vulnerable ardrv.sys driver to disk.
FileSure operates at the Windows kernel level via a filter driver that intercepts file operations before they complete. A rule that prevents email clients and browsers from writing executable files blocks the installer from landing on disk in the first place.
No installer on disk means no DLL sideloading chain. No DLL sideloading means no vulnerable driver installation. No driver means no BYOVD technique to disable security tools. No disabled security tools means no Spark RAT deployment.
The attack ends at the delivery stage, before any of the sophisticated evasion and persistence mechanisms engage.
Example FileSure Rule Configuration
Rule name: Block executable delivery from email and web
File name filter: *.exe;*.dll;*.sys;*.scr;*.bat;*.cmd;*.ps1;*.vbs
Program name filter: \outlook.exe;\thunderbird.exe;\chrome.exe;\firefox.exe;\msedge.exe;\iexplore.exe
Operations: Write, Create
Drive type: Fixed drives
Action: Deny
Result: Email clients and browsers cannot write executable files, DLLs, drivers, or scripts to local hard drives. Phishing attachments and malicious downloads are blocked at delivery. The payload never lands, so the attack chain never starts.
This rule prevents the Inno Setup installer from being written to disk when the victim extracts the phishing archive or downloads it via a browser. Without the installer on disk, none of the subsequent stages — DLL sideloading, driver installation, persistence, BYOVD, or RAT deployment — can occur.
Start Protecting Your Systems Today
FileSure Defend runs on Windows systems from Server 2003 through Server 2022 and Windows 10/11. It operates silently at the kernel level with less than 2% CPU impact and does not conflict with existing antivirus or endpoint tools.
Start your free 21-day trial at bystorm.com — full functionality, no credit card required.
Source: Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Category: Threat Intelligence
Tags: spark rat, byovd, bring your own vulnerable driver, opswat, dll sideloading, kernel filter driver, file system security, phishing
