--- title: Spark RAT Campaign Abuses OPSWAT ardrv.sys Driver to Kill Security Tools - Capstone Technologies Group description: Spark RAT campaign exploits OPSWAT ardrv.sys driver CVE-2026-36425 to disable Microsoft Defender, Huorong, and Tencent security tools targeting Cambodia. canonical_url: https://captechgroup.com/threat-intelligence-center/spark-rat-campaign-abuses-opswat-ardrvsys-driver-t-9d1652 language: en-GB date: 2026-08-27T12:34:58Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/spark-rat-campaign-abuses-opswat-ardrvsys-driver-t-9d1652. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 4902 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/spark-rat-campaign-abuses-opswat-ardrvsys-driver-t-9d1652. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. A campaign against individuals and organizations in Cambodia is installing **Spark RAT**, an open-source, Go-based cross-platform remote access trojan, after first disabling the endpoint security agents on the host. Acronis Threat Research Unit found the malicious artifacts between late June and early August 2026, and researchers Darrel Virtusio and Subhajeet Singha note it is unclear whether the activity is still running. Details in this article come from analysis published by [The Hacker News](https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html "Source: The Hacker News"). The step that matters for defenders is the **bring your own vulnerable driver (BYOVD)** stage. The operators install `ardrv.sys`, a legitimate signed driver belonging to OPSWAT AppRemover, which carries **[CVE-2026-36425](https://nvd.nist.gov/vuln/detail/CVE-2026-36425 "NVD: CVE-2026-36425")**. Because the driver is signed and trusted by Windows, it loads into the kernel without tripping driver-signing enforcement, and the attackers then use it to terminate security processes including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. That inversion is the whole point. A component built to remove security software becomes the mechanism that removes yours, and it does so from the kernel, where user-mode protections cannot intervene. If your endpoint agent is your primary source of telemetry, the attacker silences the sensor before the RAT ever calls home. There is lineage here. The BYOVD routine also references drivers from **TrueSight** (Adlice) and the **Zemana Anti-Malware SDK**, both previously used by the **Silver Fox** threat actor ahead of dropping **Winos 4.0** (also called **ValleyRAT**). The targeting of Huorong processes has appeared repeatedly in past Silver Fox activity, as has DLL sideloading through a signed application and persistence via Windows services and scheduled tasks. > Acronis tracks the activity as "an unattributed cluster with possible Chinese-language development or deployment links and operational similarities to the broader Silver Fox ecosystem," an assessment it rates low confidence. The outcome for a compromised host is unmonitored remote control. Spark RAT gives the operator interactive access to a machine whose defenses have been shut down at the kernel level, which means file access, credential theft, and onward movement proceed without endpoint alerts. ## From Inno Setup Installer to Kernel-Level Process Termination The chain starts with a compressed archive delivered by phishing, containing an Inno Setup executable. Inno Setup is a legitimate Windows installer framework, so the file looks like ordinary software packaging to a user and to naive file-type filtering. Running it kicks off DLL side-loading (MITRE **T1574.002**) through a signed Tencent executable, which pulls in interim payloads. Before anything unpacks, the DLL loader runs a timing check against sleep delays. If the elapsed time falls outside an expected range, indicating a sandbox that accelerates or manipulates sleeps, execution stops. That is **T1497** behavior, and its practical effect is that automated detonation in your sandbox tier may return a clean verdict on a sample that runs fine on a real desktop. The loader also enumerates running processes for `HipsTray.exe`, the tray component of Huorong Internet Security. When it finds that process, it attempts to weaken the security product's privileges before continuing. Shellcode for the next stage is hidden inside a PNG file shipped in the archive, decrypted at runtime, an approach that keeps executable code out of files an inspection engine would treat as suspicious. The second stager checks its own privilege level and branches: - **Inject mode** (already SYSTEM): skips persistence setup, decrypts shellcode from a second PNG, and injects it into `vssvc.exe`, the Windows Volume Shadow Copy service host. - **Setup mode** (not SYSTEM): checks for hard-coded Qihoo 360 processes and, if none are present, registers Windows service persistence (**T1543.003**) pointing at the binary that side-loads the DLL, restarting the whole chain, then injects into `vssvc.exe`. The injected code is watched. If `vssvc.exe` terminates or reappears under a new PID, the shellcode is injected again. Killing the malicious thread without removing the service entry and the loader on disk buys minutes, not a remediation. From there the payload patches AMSI and ETW functionality, which removes the script-scanning and telemetry channels many endpoint products depend on for behavioral visibility, and adds a scheduled task alongside the service for redundant persistence. Then it installs `ardrv.sys` and uses the CVE-2026-36425 flaw to terminate Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. The reason this driver is a useful pick is that process termination is what it was built to do. AppRemover exists to strip stubborn security agents off a machine, so the kernel-mode capability is native functionality reached from user mode, not a memory-corruption primitive that has to be groomed into a write. Kernel-level termination reaches processes that user-mode tampering protection is specifically designed to shield. A third PNG payload is decrypted to perform user-mode termination against a hard-coded process list, covering anything the driver route misses. A fourth PNG yields shellcode injected into `ctfmon.exe`, and that is what finally runs Spark RAT for remote control of the host. Two separate legitimate Windows binaries end up hosting attacker code, so process-name allowlists provide no signal. The BYOVD routine also references drivers belonging to TrueSight and the Zemana Anti-Malware SDK. Both appear in Silver Fox operations that preceded Winos 4.0, also tracked as ValleyRAT, and the shared tradecraft includes Defender exclusions, service and scheduled-task persistence, and side-loading through signed applications. Artifacts the chain leaves behind include a driver written to a user-writable directory and registered as a service, a scheduled task created by a freshly installed application, PNG files sitting beside an Inno Setup payload, and injected code inside `vssvc.exe` and `ctfmon.exe`. The Spark RAT configuration also contains a Chinese-language value. Inno Setup loader to driver-based defense termination 1 A compressed archive arrives by phishing and holds an Inno Setup executable. The legitimate installer framework makes the file look like ordinary software packaging to users and to file-type filtering.Medium 2 Execution triggers DLL side-loading through a signed Tencent executable, which pulls in interim payloads under a trusted process name.T1574.002 3 The loader times sleep delays and halts when the elapsed range suggests an accelerated sandbox, so automated detonation can return a clean verdict. It also hunts the Huorong tray process to weaken that product's privileges, then decrypts next-stage shellcode hidden in a PNG.HipsTray.exe 4 Running as SYSTEM, the stager injects shellcode straight into the Volume Shadow Copy service host. Otherwise it checks for hard-coded Qihoo 360 processes, registers a Windows service pointing at the side-loading binary, then injects. A watcher re-injects when the host process restarts under a new PID.vssvc.exe 5 The payload patches AMSI and ETW to cut script scanning and behavioral telemetry, adds a scheduled task beside the service for redundant persistence, then installs a vulnerable driver and abuses its flaw to terminate Microsoft Defender and Huorong Internet Security.ardrv.sysHigh ## What Losing EDR Visibility Means for the Business The kernel-level stage ends with security processes terminated, including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. From your side of the console, that host does not generate an incident. It generates nothing at all. The payload also attempts to patch AMSI and ETW functionality, which are the interfaces your tooling depends on to see script content and in-process execution events. When those are patched, the activity still happens and simply produces no record. That closes off the retrospective hunt as well as the live alert, so a forensic review weeks later has a hole in it rather than a trail. Dwell time is the direct cost. The clock runs from the moment the agent is terminated until someone notices the machine stopped reporting, and if your [SOC](https://captechgroup.com/services/managed-it-solutions "Comprehensive Managed IT Services | Dayton, Columbus, Cincinnati") workflow measures health by alert volume, the compromised endpoint looks like your quietest asset. Investigations that normally start with an [EDR](https://captechgroup.com/services/cybersecurity-services "Cybersecurity Services | Protect Your Business with Capstone Technologies") detection instead start with a downstream symptom, such as an unusual authentication, a helpdesk ticket, or a third-party notification. Once the agent is down, the operators have persistent interactive control of the host through Spark RAT. That access is suitable for: - Harvesting credentials and browser-stored secrets from a machine that is no longer being watched - Lateral movement using those credentials, where activity looks like normal user behavior to your identity logs - Staging and compressing files for exfiltration on local disk before any transfer occurs - Handoff or resale of the access to ransomware crews or other financially motivated operators The shellcode is injected into `vssvc.exe` and `ctfmon.exe`, both expected Windows processes on a normal workstation. If your network monitoring or allow-listing is keyed to process names, outbound command-and-control traffic from the Volume Shadow Copy Service host process will not stand out in a flow review. Scoping matters here because the operational similarities point toward the broader Silver Fox ecosystem, which has historically focused on Chinese-speaking users and organizations before expanding elsewhere. The Spark RAT configuration contains a Chinese-language value, and the security products it targets are ones commonly deployed in Chinese-speaking environments. If you run Chinese-language endpoints, have staff, subsidiaries, or contractors in Southeast Asia, or your users receive documents from Cambodian counterparties, treat this cluster as in-scope even though Acronis rates attribution at low confidence. The lure breadth also widens your exposed population. Government notices, public health announcements, dental examination records, real estate documents, and promotional offers are the kind of attachments that land with HR, facilities, finance, and administrative staff, not only with technical users. Those are often the accounts with broad file share access and the least practice at scrutinizing an installer. There is a compliance dimension that is easy to miss. If your endpoint agent is the control you cite in a regulatory attestation, a client security questionnaire, or a cyber-insurance application, a period in which that agent was terminated on a host is a gap in the control you certified. You will need to be able to state which endpoints lost coverage and for how long, and the operators also add Microsoft Defender exclusions, which can outlast the intrusion and quietly reduce coverage after cleanup. Reconstructing that timeline is considerably harder when the telemetry that would prove it was the first thing switched off. ## Blocking Vulnerable Drivers and Hunting for ardrv.sys Activity Start by finding out whether `ardrv.sys` exists anywhere in your estate. Sweep endpoints for the file name and hash, then compare each hit against your software inventory. If a machine has the driver but no record of a legitimate OPSWAT AppRemover deployment, treat that host as compromised and pull it for investigation instead of simply deleting the file. Where AppRemover is genuinely in use, apply the fixed version OPSWAT supplies for CVE-2026-36425 as listed in the vendor's advisory. Uninstalling the product does not always remove the driver, so confirm the service entry under `HKLM\SYSTEM\CurrentControlSet\Services` is gone after removal. Next, verify that the **Microsoft Vulnerable Driver Blocklist** is enforcing and not just switched on. Check HVCI and memory integrity status on a sample of endpoints and confirm the policy is in enforce mode rather than audit. A blocklist in audit mode logs the driver load and permits it, which produces a record of the compromise without preventing it. Add explicit WDAC deny rules for the ardrv.sys hashes plus the **TrueSight** and **Zemana Anti-Malware SDK** drivers referenced in this BYOVD routine. Those same drivers have been reused across multiple campaigns, so denying them by hash closes a set of known kernel entry points, not only this one. ### Detection work for this week - Alert on new kernel service creation and on driver loads originating from `%TEMP%`, `%APPDATA%`, or any user profile path. Legitimate drivers install from vendor packages, not from a user's download folder. - Alert on endpoint agent service stop and tamper events, and treat an agent that stops sending heartbeats as an incident with an owner rather than a health ticket in a queue. - Confirm tamper protection is enabled on every agent and cannot be turned off by a local administrator account. - Hunt retroactively for **Spark RAT** WebSocket command-and-control traffic in proxy and firewall records covering late June through early August 2026, since that beaconing may be the only surviving artifact on a host where local telemetry was cut. In environments Capstone manages, SentinelOne flags agent tamper attempts and kernel driver loads that fall outside approved software, which is the control that matters when the attacker's goal is to remove your visibility before running the RAT. ### Reducing the delivery path Restrict who can install software. Standard users with local administrator rights are what make the driver installation stage viable, and removing those rights on general-purpose workstations blocks the privilege escalation the chain depends on. Pair that with application control rules that block installers arriving from untrusted sources, including Inno Setup packaged executables delivered by mail or downloaded from web links. Over the next quarter, move toward a driver allowlist posture where only signed drivers tied to approved products can load. Build the allowlist in audit mode first, review what the logs show, then enforce. Along the way, inventory any product in your environment that ships a kernel driver capable of terminating processes, including remediation utilities, uninstall helpers, and legacy anti-malware removal tools. Those components carry the capability an attacker wants, so each one needs a current version and a documented business reason to remain installed. Finally, document which hosts you cleared and which you rebuilt. A host where a kernel driver terminated security processes should be reimaged, because the local record of what ran afterward is incomplete. ## Priorities for Defending Against Signed-Driver Abuse The BYOVD routine in this campaign also references drivers belonging to **TrueSight** and the **Zemana Anti-Malware SDK**, both of which appeared in earlier Silver Fox activity ahead of Winos 4.0 (ValleyRAT) deployment. That is the detail worth carrying into your planning. The operators keep the loader chain and swap the signed driver, which means any control that depends on knowing the specific driver name in advance will trail the next sample. Acronis is explicit that this is a low-confidence assessment, tracked as an unattributed cluster with possible Chinese-language development links and operational similarities to the broader Silver Fox ecosystem. There is no shared infrastructure, function-level code reuse, or matching certificate to close the loop. For your risk decisions, the attribution question changes little, because a chain that side-loads through a signed application, escalates through a vulnerable kernel driver, and terminates your agent behaves identically whether Silver Fox runs it or an operator copying the playbook does. The controls that hold up across driver swaps are application control that governs what executables and drivers are permitted to load in the first place, and treating the absence of telemetry as evidence. When a managed endpoint stops reporting and no one scheduled maintenance on it, that silence is your alert. Your console showing nothing on a host is a different condition from your console showing clean. The one thing to confirm this week is that vulnerable driver blocking is set to enforce rather than audit on every managed endpoint, and that no `ardrv.sys` installation exists in your environment without a matching OPSWAT AppRemover deployment record. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-08-27T12:34:58Z", "datePublished": "2026-08-27T12:34:58Z", "description": "Spark RAT campaign exploits OPSWAT ardrv.sys driver CVE-2026-36425 to disable Microsoft Defender, Huorong, and Tencent security tools targeting Cambodia.", "headline": "Spark RAT Campaign Abuses OPSWAT ardrv.sys Driver to Kill Security Tools", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/spark-rat-campaign-abuses-opswat-ardrvsys-driver-t-9d1652" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/spark-rat-campaign-abuses-opswat-ardrvsys-driver-t-9d1652" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```