Loading story…
A multi-stage phishing campaign targeted Cambodian individuals and organizations with localized lures posing as government COVID-19 notices, public-health materials, real-estate documents, and dental records. Malicious archives delivered an Inno Setup executable that used a signed Tencent binary for DLL sideloading, extracted encrypted payloads concealed in PNG files, and injected the final payload—SparkRAT, an open-source Go-based remote-access trojan—into ctfmon.exe. The RAT was configured to communicate over TCP/443 with sx.nuihuw.com, with nuihuw.top identified as a backup command-and-control server.
The operators used the vulnerable OPSWAT AppRemover driver, ardrv.sys, in a bring-your-own-vulnerable-driver attack. Exploitation of CVE-2026-36425 enabled privilege elevation and termination of security-product processes, complementing persistence and defense-evasion measures. While the operation resembles reported Silver Fox tradecraft, researchers found no shared infrastructure, code reuse, or certificate overlap to substantiate that attribution; the cluster remains unattributed, with only low-confidence indications of Chinese-language development or deployment links.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Acronis Threat Research Unit published technical details of the Cambodia-focused SparkRAT campaign, including its Cambodian COVID-19 lure, F7u00ex.exe/WfoY.qf DLL-sideloading chain, PNG-staged payloads, TaskHandler persistence, and abuse of ardrv.sys to terminate security processes. Acronis noted similarities to SilverFox-style activity but did not confirm attribution.
An unattributed cluster targeted individuals and organizations in Cambodia with Cambodia-themed phishing lures delivering SparkRAT. The multi-stage chain used Tencent DLL sideloading, PNG-hidden encrypted payloads, process injection, persistence, and the vulnerable OPSWAT AppRemover driver ardrv.sys (CVE-2026-36425) to impair security tools.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Researchers reported that **SparkRAT** was distributed through the installer of a legitimate-looking VPN application after the VPN service was likely compromised. A malicious **.NET dropper** hosted on the vendor’s official website delivered both the expected VPN setup package and malware, allowing the RAT to install while the normal installer ran to avoid suspicion. The campaign used a multi-stage infection chain, established persistence with **Windows Task Scheduler**, and deployed both `x64` and `x86` SparkRAT variants, with command-and-control traffic observed over **HTTPS** for `x64` samples and **HTTP** for `x86` samples. The activity aligns with broader reporting on **DragonSpark**, a threat cluster linked to SparkRAT and Golang-based tradecraft designed to evade detection. AhnLab said the compromised installer was Korean-language only, while the VPN website supported multiple languages and appeared to attract substantial installation activity from users in China, suggesting the campaign may have reached victims across multiple regions. Researchers published malware hashes, detection names, and C2 indicators tied to the operation, underscoring the risk of attackers abusing trusted software distribution channels to deliver remote access malware.
Aug 15, 2026
Breakglass Intelligence reported an active campaign using a custom AsyncRAT fork dubbed **PhishingRAT**, attributed to a Vietnamese-speaking cybercriminal operator. Investigators linked at least 12 samples built around lure themes including **PhishingRAT**, **RobloxHack**, and **Spotify**, and identified live, Cloudflare-fronted command-and-control infrastructure at `alam[.]it[.]com`, `datadreamers[.]in[.]net`, `sc88[.]now`, and `indotech[.]it[.]com`. The malware retained standard AsyncRAT capabilities such as keylogging, remote control, persistence via registry Run keys and scheduled tasks, and data exfiltration, while also adding HTTP flood functionality, aggressive persistence, and behavior intended to disable Microsoft Defender. The campaign’s defining feature was a **sandbox pollution engine** that generated large volumes of fake malicious activity instead of simply terminating in analysis environments. Researchers observed simulated phishing POSTs, SQL injection, ransomware actions, credential theft, fake credit-card submissions, crypto-mining, port scanning, and other decoy behaviors designed to overwhelm PCAPs and automated detections while concealing genuine RAT traffic. Attribution was supported by multiple operational security failures, including a leaked Vietnamese-language debug PDB path, Debug builds, plaintext configuration data, weak hardcoded AES keys, reused mutexes, and the campaign label **`TestVT`**, suggesting repeated testing against VirusTotal.
Jun 29, 2026