Spark RAT Campaign Targets Cambodia, Exploits Vulnerable OPSWAT Driver

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics, according to Acronis Threat researchers.

The attack chain is notable for its use of a vulnerable OPSWAT driver to disable security tools on targeted systems. By exploiting this driver vulnerability, the Spark RAT payload can neutralize security defenses, facilitating deeper system compromise and potential unauthorized access, data exfiltration, and other malicious activities.

The diversity of lure themes — spanning government notices, public health materials, and real estate content — indicates a deliberate effort by the threat actors to cast a wide net and maximize infection potential across different victim profiles in Cambodia. The use of an OPSWAT driver vulnerability to disable security tools represents a significant escalation in the attack methodology, as it targets the foundational security layer of the affected systems.

Acronis researchers have documented the campaign, highlighting the combination of social engineering through varied lures and technical exploitation of a driver vulnerability as key characteristics of this Spark RAT operation targeting the Cambodia region.