Loading malware…
Spark RAT is an open-source remote-access trojan written in Go that supports Windows, Linux, and macOS. It provides operators with remote control of compromised devices and a range of commands for controlling the target system. Its publicly available code has been adopted and modified by multiple threat actors for post-compromise access.
Spark RAT has been deployed through phishing and spearphishing, malicious installers, and exploitation of vulnerable infrastructure. A campaign targeting individuals and organizations in Cambodia used government, public-health, and real-estate lures to deliver compressed archives containing Inno Setup installers. Its Windows deployment chain combined DLL side-loading through a signed Tencent executable, encrypted shellcode concealed in PNG files, and process injection. Supporting components established Windows-service and scheduled-task persistence, performed anti-sandbox checks, attempted to impair security products, and abused a vulnerable OPSWAT AppRemover driver for privilege escalation and security-process termination. These behaviors belong to the deployment chain rather than necessarily to the unmodified Spark RAT codebase.
Users of Spark RAT include FamousSparrow, which deployed a modified version; SideCopy, in attacks against Indian sectors; Cyber Anarchy Squad, targeting Russia and Belarus; and Storm-2077, also tracked as RedNovember, TAG-100, and UNK_ColtCentury. Storm-2077 activity has included targeting government, defense, aerospace, legal-services, and semiconductor organizations. Actors associated with BianLian and Jasmin have also distributed Spark RAT through exploitation of the TeamCity authentication-bypass vulnerability CVE-2024-27198.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The file Ntmssvc.dll is described as a “Modified Spark RAT.” | The Ntmssvc.dll sample is described as a "Modified Spark RAT."
...compromise of vulnerable VPNs, firewalls, and other security solutions with Pantegana and Spark RAT...
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Listed in the later FamousSparrow ATT&CK matrix.
"Threat actors have been observed exploiting ... CVE-2026-1731 ... allows attackers to execute operating system commands in the context of the site user... leverage the affected 'thin-scc-wrapper' script that's reachable via WebSocket interface to inject and execute arbitrary shell commands"
“Attackers distribute compressed archives containing an Inno Setup executable via phishing emails, using lures such as government notices, public health materials, and real estate documents relevant to Cambodia.”
The payload performs the following sequence of actions - Attempt to patch AMSI and ETW related functionality; Setup persistence using a scheduled task.
The payload performs the following sequence of actions - Attempt to patch AMSI and ETW related functionality; Setup persistence using a scheduled task.
If none of them are found, it sets up a Windows service-based persistence mechanism to launch the binary that sideloads the DLL to relaunch the entire cycle all over again.
The payload performs the following sequence of actions - Attempt to patch AMSI and ETW related functionality; Setup persistence using a scheduled task.
The inject mode works by parsing and decrypting shellcode embedded in another PNG file from the archive, and then injecting it into 'vssvc.exe'... A fourth PNG-based payload file... [is] injected into 'ctfmon.exe,' ultimately leading to the execution of Spark RAT.
“The campaign utilizes a ‘bring your own vulnerable driver’ (BYOVD) technique, leveraging a legitimate but vulnerable driver (ardrv.sys) associated with OPSWAT AppRemover to escalate privileges and disable security software.”
If none of them are found, it sets up a Windows service-based persistence mechanism to launch the binary that sideloads the DLL to relaunch the entire cycle all over again.
In the next stage, it decrypts shellcode concealed within a PNG file present in the archive to run a second stager.
The inject mode works by parsing and decrypting shellcode embedded in another PNG file from the archive, and then injecting it into 'vssvc.exe'... A fourth PNG-based payload file... [is] injected into 'ctfmon.exe,' ultimately leading to the execution of Spark RAT.
“The attack chain includes anti-sandbox checks.”
The DLL loader also carries out a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and proceeds to terminate execution if the elapsed time falls outside the expected range.
“[The BYOVD technique is used] to escalate privileges and disable security software” and the chain “attempts to disable security products like Microsoft Defender and Huorong Internet Security.”
It reviews running processes for those related to Huorong Internet Security ('HipsTray.exe')... [and] checks for a list of hard-coded processes associated with Qihoo 360.
“The attack chain includes anti-sandbox checks.”
The DLL loader also carries out a timing-based anti-sandbox check to detect environments that shorten or manipulate sleep delays, and proceeds to terminate execution if the elapsed time falls outside the expected range.
"...web shell deployment, command-and-control (C2), backdoor and remote management tool installs..."
"...backdoor and remote management tool installs... Deploying malware such as VShell ... and Spark RAT"
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.