Loading story…
Researchers reported that SparkRAT was distributed through the installer of a legitimate-looking VPN application after the VPN service was likely compromised. A malicious .NET dropper hosted on the vendor’s official website delivered both the expected VPN setup package and malware, allowing the RAT to install while the normal installer ran to avoid suspicion. The campaign used a multi-stage infection chain, established persistence with Windows Task Scheduler, and deployed both x64 and x86 SparkRAT variants, with command-and-control traffic observed over HTTPS for x64 samples and HTTP for x86 samples.
The activity aligns with broader reporting on DragonSpark, a threat cluster linked to SparkRAT and Golang-based tradecraft designed to evade detection. AhnLab said the compromised installer was Korean-language only, while the VPN website supported multiple languages and appeared to attract substantial installation activity from users in China, suggesting the campaign may have reached victims across multiple regions. Researchers published malware hashes, detection names, and C2 indicators tied to the operation, underscoring the risk of attackers abusing trusted software distribution channels to deliver remote access malware.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
ASEC reported that a legitimate-looking Korean VPN installer downloaded from the service's official website had been replaced with a .NET dropper carrying SparkRAT alongside the original installer. ASEC assessed that the threat actor likely compromised a legitimate VPN service to distribute the malware.
SentinelOne published prior reporting on the DragonSpark campaign, describing SparkRAT use and associating it with threat actors believed to be fluent in Chinese. This reporting was later referenced by ASEC in its analysis of the VPN-installer campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A multi-stage phishing campaign targeted Cambodian individuals and organizations with localized lures posing as government COVID-19 notices, public-health materials, real-estate documents, and dental records. Malicious archives delivered an Inno Setup executable that used a signed Tencent binary for DLL sideloading, extracted encrypted payloads concealed in PNG files, and injected the final payload—**SparkRAT**, an open-source Go-based remote-access trojan—into `ctfmon.exe`. The RAT was configured to communicate over TCP/443 with `sx.nuihuw.com`, with `nuihuw.top` identified as a backup command-and-control server. The operators used the vulnerable OPSWAT AppRemover driver, `ardrv.sys`, in a bring-your-own-vulnerable-driver attack. Exploitation of **CVE-2026-36425** enabled privilege elevation and termination of security-product processes, complementing persistence and defense-evasion measures. While the operation resembles reported Silver Fox tradecraft, researchers found no shared infrastructure, code reuse, or certificate overlap to substantiate that attribution; the cluster remains unattributed, with only low-confidence indications of Chinese-language development or deployment links.
Aug 28, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Breakglass Intelligence reported an active campaign using a custom AsyncRAT fork dubbed **PhishingRAT**, attributed to a Vietnamese-speaking cybercriminal operator. Investigators linked at least 12 samples built around lure themes including **PhishingRAT**, **RobloxHack**, and **Spotify**, and identified live, Cloudflare-fronted command-and-control infrastructure at `alam[.]it[.]com`, `datadreamers[.]in[.]net`, `sc88[.]now`, and `indotech[.]it[.]com`. The malware retained standard AsyncRAT capabilities such as keylogging, remote control, persistence via registry Run keys and scheduled tasks, and data exfiltration, while also adding HTTP flood functionality, aggressive persistence, and behavior intended to disable Microsoft Defender. The campaign’s defining feature was a **sandbox pollution engine** that generated large volumes of fake malicious activity instead of simply terminating in analysis environments. Researchers observed simulated phishing POSTs, SQL injection, ransomware actions, credential theft, fake credit-card submissions, crypto-mining, port scanning, and other decoy behaviors designed to overwhelm PCAPs and automated detections while concealing genuine RAT traffic. Attribution was supported by multiple operational security failures, including a leaked Vietnamese-language debug PDB path, Debug builds, plaintext configuration data, weak hardcoded AES keys, reused mutexes, and the campaign label **`TestVT`**, suggesting repeated testing against VirusTotal.
Jun 29, 2026