Loading malware…
SparkRAT is an open-source remote administration tool written in Go that is abused as a remote access trojan. It supports Windows, Linux, and macOS and provides remote command execution, file and process management, payload downloading, screenshot capture, and system-information collection. It communicates with command-and-control servers over WebSocket and includes an automatic update mechanism. These functions enable remote control, information theft, and follow-on payload deployment.
SparkRAT has been deployed after exploitation of internet-facing enterprise applications, including Apache ActiveMQ through CVE-2023-46604, vulnerable JetBrains TeamCity servers, and BeyondTrust Remote Support and Privileged Remote Access through CVE-2026-1731. ActiveMQ exploitation delivering SparkRAT was observed as early as October 10, 2023, before public disclosure of the vulnerability. Other distribution methods include trojanized VPN installers that execute legitimate setup software alongside the malware and certificate-renewal phishing associated with UAC-0194 that exploited Windows vulnerability CVE-2024-43451. Windows deployments have established persistence through automatic-start services, scheduled tasks, and startup-folder execution.
SparkRAT is associated with the DragonSpark intrusion cluster targeting organizations in East Asia and has also appeared among tools used by Houken. An unattributed Cambodia-focused Windows campaign delivered it through document-themed lures and a multistage loading chain involving DLL sideloading, process injection, security-product impairment, and vulnerable-driver abuse. In that campaign, SparkRAT was reflectively loaded into a legitimate process. These loading and evasion mechanisms belong to the surrounding deployment chain rather than necessarily to SparkRAT itself. Its public availability and use across distinct campaigns preclude attribution of a SparkRAT infection to a single threat actor.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
9 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The other files detected exploiting the new vulnerability followed a similar attack scenario that ended with the installation of Redline Stealer malware. The similarity has two possible explanations: 1. One attacker using different types of malware (the initial file installs SparkRAT malware).
The following public tools were observed on the victims’ network... SparkRAT.
Sandbox family search for family:sparkrat . Returned a per-victim SparkRAT sibling submitted independently to the sandbox. Its ldflags COMMIT differs from the case sample. Confirms the operator uses per-target SparkRAT builds.
...Leslieloader that downloads a backdoor dubbed SparkRAT. The Go variants are compliant with Windows, Linux and OSX. They support file upload and download, system fingerprinting and direct command-line interaction with infected hosts.
"...including CurlBack, SparkRAT, AresRAT, Xeno RAT, AllaKore, and ReverseRAT."
The attacks are characterized by the use of the little known open source SparkRAT and malware that attempts to evade detection through Golang source code interpretation.
+3 more in the app. View in Mallory
43 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2026-1731, an unauthenticated OS command injection vulnerability in BeyondTrust Privileged Remote Access and Remote Support... Threat actors used it in targeted initial-access campaigns.
it seems that the threat actor attacked the development company and distributed installers with malware strains
CERT-UA shared technical information with ClearSky regarding the email sent to the target to launch the attack chain. The lure email message is sent from a Ukrainian government server. The message body includes a demand to renew the academic certificate, as the current certificate is allegedly about to expire.
Furthermore, the malware is registered in the task scheduler to ensure it will be executed even after system reboots.
"schtasks /create /tn \"TaskHandler\" /tr \"C:\Drivers\mQm\F7u00ex.exe\" /sc ONSTART /ru \"NT AUTHORITY\SYSTEM\" /rl HIGHEST"
It provides features to control the infected system such as executing commands
This version supports 26 commands that implement a wide range of functionalities: Command execution: including execution of arbitrary Windows system and PowerShell commands.
A cmd.exe process is spawned by java.exe out of the respective Apache ActiveMQ application folder.
The vulnerability, tracked as CVE-2026-1731, is an operating system command injection flaw ... The flaw allows an attacker to execute arbitrary commands on a server without the need for credentials or any user interaction.
Using programming language Autolt to execute SparkRAT malware.
When examining the URL file, ClearSky’s team exposed a new vulnerability, unrelated to the two vulnerabilities mentioned above: Right clicking the file establishes a connection to an external server.
L'exploit permet à des acteurs malveillants de prendre le contrôle d'un système par un simple clic droit sur un fichier malveillant.
The vulnerability is exploited by generating a URL file that can be activated using the following non-standard actions: 1. A single right-click (in all versions of Windows). 2. Deleting the file by using the delete button (only in Windows 10/11). 3. Dragging the file to another folder.
Furthermore, the malware is registered in the task scheduler to ensure it will be executed even after system reboots.
"schtasks /create /tn \"TaskHandler\" /tr \"C:\Drivers\mQm\F7u00ex.exe\" /sc ONSTART /ru \"NT AUTHORITY\SYSTEM\" /rl HIGHEST"
The native sc.exe tool is used to create a service to establish persistence for the SparkRAT payload.
“Unit 42 confirmed the flaw is being actively exploited for… backdoor installation…”
Creating an additional layer of persistence by copying file SyncWave360[.]js to the startup folder.
Furthermore, the malware is registered in the task scheduler to ensure it will be executed even after system reboots.
"schtasks /create /tn \"TaskHandler\" /tr \"C:\Drivers\mQm\F7u00ex.exe\" /sc ONSTART /ru \"NT AUTHORITY\SYSTEM\" /rl HIGHEST"
The campaign included "process injection" and moved code through "vssvc.exe, ctfmon.exe and svchost.exe," with SparkRAT injected through later stages.
The attackers escalated privileges, exfiltrated data and dropped payloads including SNOWLIGHT, SPARKRAT and cryptominers.
The native sc.exe tool is used to create a service to establish persistence for the SparkRAT payload.
“Unit 42 confirmed the flaw is being actively exploited for… backdoor installation…”
Creating an additional layer of persistence by copying file SyncWave360[.]js to the startup folder.
Then a file named Learn[.]cmd is dropped and executed. The CMD file includes commands encoded by adding garbage strings and using several variables that, when put together, create the commands.
The report identifies "PNG-staged payload files," including "56360VK1ES8.yvap," "BssBfeFFoA3A.nz," "cnV.rb," and "d7zzQhzRglBv.es."
The loader then extracts encrypted stages from several PNG-formatted files... It decrypts its embedded configuration using AES-CTR.
The campaign used an Inno Setup executable disguised as a Cambodian government document: "Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe."
The campaign included "process injection" and moved code through "vssvc.exe, ctfmon.exe and svchost.exe," with SparkRAT injected through later stages.
File and process manipulation: including process termination as well as file upload, download, and deletion.
The commands carried out by file Learn[.]cmd: • Tasklist[.]exe – listing all tasks running on the system. • findstr /I avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe – checking for installed AV engines. • findstr /I "wrsa.exe opssvc.exe" – checking for additional security components.
The payload recovered from d7zzQhzRglBv.es is injected into ctfmon.exe. The primary routine is to reflectively load an embedded PE payload into memory... identified it as SparkRAT.
Most malware samples had certificates disguised as valid ones from this company. There were also multiple samples signed with valid certificates.
The malware used ardrv.sys "to terminate security-related processes, including Microsoft Defender components" and created Defender exclusions for VSSVC.exe, ctfmon.exe, C:\Drivers, and C:\Windows\System32.
La faille de sécurité « CVE-2024-43451 » est une vulnérabilité de divulgation de hash NTLM par usurpation d'identité, qui peut être exploitée pour voler le hash NTLMv2 de l'utilisateur connecté en le forçant à se connecter à un serveur distant contrôlé par un attaquant.
SparkRAT provides basic features commonly found in RAT malware, such as executing commands, stealing information, and controlling processes and files.
SparkRAT spawns a child process of cmd ver (T1082 – System Information Discovery).
SparkRAT provides basic features commonly found in RAT malware, such as executing commands, stealing information, and controlling processes and files.
The commands carried out by file Learn[.]cmd: • Tasklist[.]exe – listing all tasks running on the system. • findstr /I avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe – checking for installed AV engines. • findstr /I "wrsa.exe opssvc.exe" – checking for additional security components.
Key initial access vectors include ... Exposed Outlook Web Access (OWA) and VPN infrastructure
The URL refers to an external server on IP address 92[.]42.96.30 using the SMB protocol (file://), to access two EXE files with similar names.
The vulnerability ... allows threat actors to execute arbitrary code by abusing the OpenWire protocol implemented by ActiveMQ.
collecting information from the infected system like by taking screenshots
The malicious installer connects to the C&C server and downloads encrypted configuration data.
SparkRAT then sends a basic victim fingerprint back to its C2 via HTTP POST request ... (T1071.001 – Application Layer Protocol: Web Protocols).
The downloaded bat file obtains SparkRAT ... via certutil (T1105 – Ingress Tool Transfer).
Microsoft researchers also identified a sample that can run on Windows based on a cross-platform (Linux, Windows, macOS) open-source remote administration tool (RAT) with various features such as managing processes, file operations, screenshotting, and running commands.
The configuration specifies "secure": true... [and includes] a 256-bit cryptographic key used during communication.
The attackers escalated privileges, exfiltrated data and dropped payloads including SNOWLIGHT, SPARKRAT and cryptominers.
File and process manipulation: including process termination as well as file upload, download, and deletion.
The attackers... dropped payloads including SNOWLIGHT, SPARKRAT and cryptominers.
68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.