Listen to this Post
Introduction: A New Cyber Threat Hides Behind Familiar Documents
A new malware campaign targeting individuals and organizations in Cambodia demonstrates how modern cyberattacks are becoming increasingly layered, deceptive, and difficult to stop.
What begins with an apparently ordinary file, such as a government notice, public health announcement, dental record, real estate document, or promotional offer, can ultimately develop into a full compromise of a Windows system. Behind the convincing lures is a multi-stage attack chain designed to bypass security software, establish persistence, escalate privileges, and deploy Spark RAT, an open-source remote access trojan capable of giving attackers remote control over infected devices.
Researchers from Acronis Threat Research Unit identified malicious activity between late June and early August 2026. The campaign combines phishing, compressed archives, Inno Setup executables, DLL side-loading, anti-sandbox techniques, shellcode concealed inside PNG files, process injection, scheduled tasks, Windows services, and the increasingly dangerous Bring Your Own Vulnerable Driver, or BYOVD, technique.
The result is not a simple malware infection. It is a carefully layered operation in which each stage appears designed to prepare the environment for the next.
Summary: From Phishing Email to Full Remote Access
The campaign appears to rely primarily on phishing emails that distribute compressed archives containing malicious executables disguised with a variety of themes.
The attackers do not appear to depend on a single lure. Instead, the discovered samples use subjects and documents that could appeal to different types of potential victims in Cambodia. These include government-related notices, public health information, dental examination records, real estate material, and commercial promotions.
Once a victim opens the malicious file, an Inno Setup executable begins the infection chain.
The installer then abuses DLL side-loading through a signed Tencent executable. DLL side-loading is a technique in which a legitimate application is manipulated into loading a malicious DLL placed in a location where the program expects a trusted library.
Using a signed application can make malicious activity appear more legitimate to both users and security products.
The campaign then moves through several additional stages before finally deploying Spark RAT.
Spark RAT: An Open-Source Tool Turned Into an Attack Platform
Spark RAT is an open-source, Go-based, cross-platform remote access trojan.
Remote access trojans are particularly dangerous because they can transform an infected computer into a remotely controllable endpoint.
Depending on configuration and available functionality, attackers can use RATs to execute commands, manipulate files, collect information, and maintain access to compromised systems.
The use of open-source malware also presents a challenge for defenders.
Attackers do not always need to build a completely custom backdoor from scratch. Publicly available tools can be modified, repackaged, and integrated into larger attack frameworks.
This can reduce development time while still allowing operators to create highly customized infection chains around the final payload.
In this campaign, Spark RAT is only the final destination.
The real sophistication lies in everything the attackers do before reaching that point.
The BYOVD Technique Turns a Legitimate Driver Into a Security Problem
One of the most concerning elements of the campaign is the use of the Bring Your Own Vulnerable Driver technique.
Instead of exploiting a vulnerability directly inside the victim’s operating system, attackers can introduce a legitimate but vulnerable driver and abuse its weaknesses to gain powerful access to the machine.
The campaign loads a vulnerable driver named ardrv.sys, associated with OPSWAT AppRemover.
According to the analysis, the vulnerable driver is linked to CVE-2026-36425 and is used as part of an effort to interfere with or terminate security-related processes.
The malware attempts to target security products including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager.
This is one reason BYOVD attacks have become increasingly important to defenders.
Security products are often designed to detect malware running in ordinary user space.
A vulnerable kernel driver, however, can potentially provide attackers with far greater control.
Once security software is weakened, the remaining stages of the attack can execute with fewer obstacles.
The Malware Checks Whether It Is Being Watched
The campaign does not immediately reveal all of its behavior.
Instead, the loader performs a timing-based anti-sandbox check.
Security researchers frequently use automated environments, virtual machines, and sandboxes to observe suspicious files safely.
Malware developers attempt to detect these environments because they want their payloads to remain hidden from analysis.
In this case, the malware checks whether sleep delays behave as expected.
If the elapsed time differs significantly from what the malware expects, execution can terminate.
This means that an automated analysis environment that accelerates time or manipulates sleep functions could accidentally reveal itself to the malware.
The loader also checks running processes for HipsTray.exe, a process associated with Huorong Internet Security.
If the security process is detected, the malware attempts to interfere with its privileges.
This demonstrates that the operation is not simply designed to infect any machine blindly.
It actively evaluates the
PNG Files Become Containers for Hidden Payloads
Another interesting component of the attack is the use of PNG files to conceal encrypted shellcode.
To an ordinary user, a PNG file appears to be an image.
Inside this campaign, however, several PNG files serve as containers for encrypted malicious data.
The loader reads the hidden content, decrypts the shellcode, and launches additional stages.
This technique helps make the archive appear less suspicious.
An archive containing executables and libraries may immediately raise concern.
An archive containing several files that appear to be images can provide attackers with additional camouflage.
The campaign reportedly uses multiple PNG-based payload stages rather than relying on a single malicious component.
Each hidden payload appears to serve a different role in the overall attack chain.
SYSTEM Privileges Determine Which Path the Malware Takes
After decrypting another stage, the malware checks whether it is already running with SYSTEM privileges.
SYSTEM is one of the most powerful security contexts available on Windows.
The result of this check determines how the malware proceeds.
If the malware already has SYSTEM privileges, it can move directly toward payload injection.
If it does not have those privileges, the malware first focuses on establishing persistence.
This design creates two operational paths.
The first path is intended for systems where the attackers have already achieved powerful privileges.
The second path prepares the compromised machine for long-term access before continuing.
This conditional execution demonstrates an effort to adapt the attack chain to the security state of the victim’s computer.
Process Injection Into vssvc.exe Helps the Malware Stay Hidden
The campaign uses process injection to run malicious shellcode inside vssvc.exe, the Windows Volume Shadow Copy Service process.
Process injection is a common technique used to hide malicious execution inside a legitimate process.
Instead of running an obvious malware executable, the malicious code operates within the memory space of a legitimate Windows process.
The malware also monitors the targeted vssvc.exe process.
If the process terminates or restarts with a new process ID, the malware can inject the shellcode again.
This creates a form of operational resilience.
Simply killing the infected process may therefore not be enough if another component remains active and is capable of performing the injection again.
For defenders, this highlights the importance of identifying the entire execution chain rather than focusing only on the final malicious process.
Setup Mode Establishes Persistence Before Continuing
If the malware is not already running with SYSTEM privileges, it enters what researchers described as a setup mode.
During this stage, it decrypts shellcode and checks for processes associated with Qihoo 360 security products.
If those processes are not found, the malware establishes persistence.
Persistence is essential for attackers who want access to survive a reboot or temporary interruption.
The campaign uses a Windows service-based persistence mechanism capable of relaunching the binary involved in the DLL side-loading chain.
This means the attackers can effectively restart the broader infection process after the system restarts.
The malware can also create scheduled tasks as part of its persistence strategy.
By combining multiple execution and persistence mechanisms, the attackers increase the number of components defenders must identify and remove.
AMSI and ETW Become Important Targets
The payload also attempts to interfere with AMSI and ETW-related functionality.
AMSI, or the Antimalware Scan Interface, is used by Windows and security products to inspect potentially malicious content.
ETW, or Event Tracing for Windows, provides telemetry that can be valuable for monitoring and detection.
Attempts to patch or disable these mechanisms are especially concerning because they can reduce the visibility available to defenders.
If security tools lose access to useful inspection or telemetry capabilities, malicious activity may become more difficult to detect.
The malware then continues with persistence operations and the installation of the vulnerable driver.
This shows that the campaign is designed around a clear objective.
First reduce visibility.
Then weaken security.
Then establish persistence.
Finally deploy the remote access payload.
A Fourth Hidden Payload Leads to Spark RAT
The attack chain reportedly processes another PNG-based payload.
This component contains encrypted shellcode that is eventually injected into ctfmon.exe.
The execution of this final stage leads to the deployment of Spark RAT.
At this point, the attackers have moved from a phishing lure to a fully operational remote access trojan.
The entire chain contains multiple layers of deception.
A compressed archive hides the initial executable.
A signed application is abused for DLL side-loading.
PNG files conceal encrypted shellcode.
Legitimate Windows processes host injected malicious code.
A vulnerable driver is used to attack security products.
Persistence mechanisms attempt to survive system restarts.
Each individual technique is dangerous.
Combined together, they create an attack chain that is significantly more difficult to analyze and remove.
Similarities to Silver Fox Create an Interesting Attribution Question
Researchers also identified operational similarities between the campaign and activity previously associated with the Silver Fox threat ecosystem.
The BYOVD routine references other drivers associated with products from TrueSight and Zemana Anti-Malware SDK.
Those drivers have previously appeared in activity connected to Silver Fox operations involving Winos 4.0, also known as ValleyRAT.
The targeting of Huorong-related security processes has also appeared in earlier Silver Fox-associated attacks.
Additional similarities include overlapping targeting patterns, DLL side-loading through signed applications, multi-stage payload delivery, Windows service persistence, scheduled tasks, and attempts to manipulate Microsoft Defender.
At first glance, these similarities may suggest a connection.
However, cybersecurity attribution requires more than behavioral resemblance.
Why Researchers Are Not Definitively Blaming Silver Fox
Acronis did not definitively attribute the campaign to Silver Fox.
The researchers noted the absence of several stronger attribution indicators.
These include shared infrastructure, function-level code reuse, and matching certificates.
The choice of final malware also creates an important distinction.
Silver Fox activity has previously been associated with ValleyRAT and other custom malware.
This campaign instead deploys an open-source RAT.
That difference does not eliminate the possibility of a relationship.
Threat actors can change their tools, borrow techniques, purchase malware, or alter their operational infrastructure.
However, the use of a different malware family removes one of the stronger technical links that might otherwise support attribution.
For now, the activity is better understood as an unattributed cluster with possible Chinese-language development or deployment connections and operational similarities to the broader Silver Fox ecosystem.
The confidence level remains low.
That assessment could change if future investigations uncover shared infrastructure, overlapping victimology, reused code, certificates, operator mistakes, or additional artifacts.
Why Cambodia May Be Facing a Broader Targeting Strategy
The variety of lures used in the campaign is particularly important.
Attackers targeting only one sector often use highly specialized documents.
This campaign appears to use government material, health-related content, real estate documents, examination records, and promotional themes.
That suggests the operators may be testing different social engineering approaches across a broader population.
A government-themed document could appeal to employees, businesses, or citizens.
A health-related notice could target medical institutions or individuals.
Real estate material could attract commercial organizations and private users.
Promotional content could reach an even wider audience.
The broad lure strategy may allow attackers to identify which themes produce the highest infection rate.
It also means defenders should not focus only on one industry.
The campaign appears flexible enough to target multiple types of victims.
The Biggest Lesson Is That Malware Campaigns Are Becoming Modular
The Spark RAT campaign illustrates a broader evolution in cybercrime and espionage operations.
Modern attacks are increasingly modular.
The phishing lure can change without changing the malware.
The DLL side-loading application can potentially be replaced.
The vulnerable driver can be swapped for another available driver.
The final RAT can also change.
What matters is the framework connecting these pieces.
Attackers can combine publicly available tools, legitimate software, vulnerable drivers, Windows features, and custom loaders into a single operation.
This makes attribution more difficult because individual components may have been used by unrelated groups.
A technique associated with one threat actor is not automatically proof that the same actor is behind every campaign using it.
The cybersecurity industry must therefore distinguish between shared tools, shared tradecraft, and shared operators.
Those are not always the same thing.
What Undercode Say:
A Multi-Stage Design Shows Deliberate Operational Planning
This campaign stands out because Spark RAT is not the most technically interesting part of the operation.
The real story is the delivery architecture surrounding it.
The attackers appear to have invested heavily in preparing the victim environment before launching the final remote access tool.
That approach reduces the importance of the final payload itself.
Spark RAT could theoretically be replaced with another RAT without fundamentally changing the attack chain.
This is a dangerous model because defenders cannot rely only on malware family signatures.
The BYOVD Stage Is One of the Most Serious Defensive Concerns
The abuse of a legitimate but vulnerable driver demonstrates how trust can become an attack surface.
Organizations may focus heavily on blocking unsigned or obviously malicious drivers.
However, a signed driver with a known vulnerability can still become a powerful weapon.
Driver inventory management should therefore be treated as a security priority.
Defenders need to know which kernel drivers exist across their environments.
They should also identify vulnerable drivers that remain present because of legacy applications or outdated software.
The Attack Chain Attempts to Break Security Before Deploying the RAT
The sequence of operations appears deliberate.
The malware checks its environment.
It attempts to avoid sandbox analysis.
It evaluates security processes.
It works toward elevated privileges.
It establishes persistence.
It attempts to weaken monitoring technologies.
Only after these stages does the operation move toward final RAT execution.
This suggests that detection opportunities exist throughout the chain.
Stopping the campaign early is significantly more valuable than waiting for the final Spark RAT process to appear.
PNG-Based Payload Concealment Is a Reminder to Inspect Content, Not Extensions
A file extension does not prove that a file is harmless.
Security systems should inspect file content and behavioral relationships.
A PNG file that is unexpectedly read by a suspicious loader immediately deserves investigation.
Analysts should examine which processes access image files.
They should also determine whether those files are followed by memory allocation, shellcode decryption, or process injection activity.
Signed Software Can Be Abused Without Being Malicious
The use of a signed Tencent executable for DLL side-loading is another reminder that trusted applications can become part of an attack.
Application reputation alone is not enough.
A legitimate executable launching from an unusual directory alongside unexpected DLL files should raise suspicion.
Security monitoring should focus on execution context.
The key question is not simply, “Is this executable signed?”
The more important question is, “Why is this signed executable loading this particular DLL from this location?”
Process Injection Requires Behavioral Detection
Injected malware can be difficult to detect through ordinary file scanning.
Defenders should monitor suspicious memory behavior.
Unexpected remote thread creation, unusual memory protections, shellcode execution, and suspicious parent-child process relationships can provide valuable detection opportunities.
Particular attention should be given to unexpected injection involving Windows service processes.
A legitimate system process is not automatically behaving legitimately.
Persistence Should Be Investigated as a Chain
A malicious service or scheduled task may only be one link in a larger operation.
Deleting the persistence mechanism without identifying the loader, payload, driver, and injected processes may leave the environment partially compromised.
Incident response teams should reconstruct the complete timeline.
They need to determine how the machine was initially infected.
They should identify every file extracted from the archive.
They should also inspect services, scheduled tasks, drivers, registry changes, and suspicious memory activity.
Attribution Must Remain Separate From Detection
The similarities to Silver Fox are operationally interesting.
However, defenders should avoid making attribution assumptions too early.
A company can still detect and respond to an attack even if the attacker remains unknown.
The techniques are actionable regardless of the identity of the operators.
Attribution should be based on evidence.
Behavioral resemblance should be treated as an investigative lead rather than a final conclusion.
Cambodia-Based Organizations Should Review Email and Endpoint Defenses
The
Email filtering should identify suspicious compressed archives and executables.
Employees should be cautious when receiving unexpected documents, particularly when the sender pressures them to run an installer.
Endpoint defenses should monitor DLL side-loading and vulnerable driver installation.
Security teams should also investigate attempts to terminate or manipulate endpoint protection processes.
The Most Effective Defense Is Layered Visibility
No single detection technology can reliably stop every stage of a campaign like this.
Email security may stop the archive.
Endpoint controls may block execution.
Application control may detect unusual DLL loading.
Driver blocklists may prevent vulnerable driver abuse.
EDR platforms may identify process injection.
SIEM systems may correlate persistence activity.
Network monitoring may detect suspicious command-and-control traffic.
The strength comes from combining these layers.
The Campaign Demonstrates Why Open-Source Malware Cannot Be Ignored
Open-source RATs can create a false sense of familiarity.
Some defenders may assume that publicly available malware is easier to detect.
That is not always true.
A well-designed loader can hide a known payload behind several layers of encryption, injection, side-loading, and privilege manipulation.
The final malware may be publicly known.
The attack chain delivering it may be completely different.
That distinction is critical.
The Future Threat Is the Combination of Techniques
The most dangerous part of this campaign is not one specific file.
It is the combination of phishing, social engineering, DLL side-loading, anti-sandbox checks, encrypted shellcode, vulnerable drivers, persistence, process injection, and remote access.
Attackers are increasingly assembling campaigns from reusable components.
Defenders must therefore build detections around attacker behavior.
A security strategy focused only on malware names will always be one step behind.
The real detection advantage comes from understanding what the attacker must do to reach the final objective.
Deep Analysis
Investigating Suspicious Drivers
Security teams can review installed and loaded drivers using Windows administrative tools and PowerShell.
driverquery /v /fo csv Get-CimInstance Win32_SystemDriver | Select-Object Name, State, PathName
On systems with centralized logging, administrators should compare driver inventories against known vulnerable driver intelligence and approved software baselines.
Unexpected installations of drivers, particularly shortly before security processes are terminated, should be investigated immediately.
Hunting for DLL Side-Loading Activity
On Windows, defenders can inspect suspicious executable locations and loaded modules.
Get-Process | Select-Object ProcessName, Id, Path Get-ChildItem "C:\ProgramData" -Recurse -ErrorAction SilentlyContinue
On Linux systems used for forensic analysis, investigators can examine extracted evidence and calculate hashes.
find ./evidence -type f -exec sha256sum {} \;
file ./evidence/
strings -a suspicious_file.exe | head -n 100
These commands can help analysts identify unexpected binaries, embedded strings, and files that do not match their claimed format.
Identifying Suspicious PNG Payload Containers
Files pretending to be normal images should be inspected rather than trusted solely because of their extension.
file suspicious.png exiftool suspicious.png binwalk suspicious.png strings -a suspicious.png | less
A file identified as PNG but containing unexpected executable structures or high-entropy embedded data should receive additional analysis.
Checking Windows Persistence Mechanisms
Defenders should investigate recently created scheduled tasks and services.
schtasks /query /fo LIST /v Get-Service | Sort-Object Status Get-CimInstance Win32_Service | Select-Object Name, DisplayName, PathName, StartMode
On a Linux forensic workstation, exported Windows artifacts can be organized and hashed.
mkdir -p incident_artifacts find ./windows_artifacts -type f -print0 | xargs -0 sha256sum > incident_artifacts/hashes.txt grep -RinE "vssvc|ctfmon|ardrv|HipsTray" ./windows_artifacts
Searching for Suspicious Process Injection Indicators
EDR telemetry should be reviewed for unusual behavior involving vssvc.exe and ctfmon.exe.
Analysts should look for unexpected parent processes, memory allocation events, thread creation, unusual module loads, and repeated execution following process restarts.
Example Linux-based log hunting can include:
grep -Rin "vssvc.exe" ./logs grep -Rin "ctfmon.exe" ./logs grep -RinE "CreateRemoteThread|VirtualAllocEx|WriteProcessMemory" ./logs
The goal is not simply to find a malware filename.
The goal is to reconstruct the sequence connecting the phishing archive to the final remote access session.
Incident Response Must Remove the Entire Chain
If Spark RAT or a related loader is identified, defenders should assume that additional persistence mechanisms may exist.
A proper investigation should examine the initial archive, extracted executables, sideloaded DLLs, PNG payloads, installed drivers, Windows services, scheduled tasks, and injected processes.
Removing only the final RAT could leave the initial loader active.
Removing only the vulnerable driver could leave persistence mechanisms in place.
The safest approach is to treat the compromise as a complete attack chain.
Research Findings and Attribution Status
✅ Acronis researchers reported a Cambodia-focused campaign using multi-stage delivery techniques, DLL side-loading, hidden payloads, BYOVD abuse, and Spark RAT based on the information provided in the original report.
✅ The campaign uses operational techniques that overlap with activity previously associated with the broader Silver Fox ecosystem, including security-product targeting and multi-stage execution patterns.
❌ There is currently not enough evidence in the reported analysis to definitively identify Silver Fox as the operator, because shared infrastructure, direct code reuse, and other stronger attribution indicators were not established.
Prediction
(+1)
Cambodia-focused organizations and regional security teams are likely to increase monitoring for suspicious archives, DLL side-loading behavior, vulnerable driver installation, and unusual activity involving vssvc.exe and ctfmon.exe.
The use of open-source RATs combined with sophisticated loaders will likely continue because attackers can rapidly change the final payload while preserving much of the surrounding attack infrastructure.
If vulnerable signed drivers remain available and trusted applications continue to be abused for side-loading, similar campaigns may become harder to detect using traditional signature-based security tools alone.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
