# Spark RAT Campaign Targets Cambodia Using Weaponized OPSWAT Driver Exploit
Attackers in Cambodia have deployed Spark RAT, an open-source remote access trojan, in a coordinated campaign that combines social engineering with a kernel-level privilege escalation attack. The operation leverages a vulnerable OPSWAT driver to disable security software and gain system-level control.
Spark RAT operates as a fully functional remote access tool that grants attackers command execution, file management, and surveillance capabilities once installed. The trojan originates from publicly available source code, making it accessible to threat actors with minimal technical sophistication. Acronis researchers identified the campaign and documented a multi-stage infection chain designed to bypass conventional endpoint protection.
The attack begins with spear-phishing emails employing geographically targeted lures. Threat actors craft messages around government notices, public health campaigns, real estate transactions, and other topics with relevance to Cambodian audiences. Recipients who open malicious attachments or click links trigger the first-stage payload delivery. This approach maximizes success rates by tailoring social engineering content to victim profiles and regional interests.
Once executed, the malware performs reconnaissance on the target system. It then exploits a vulnerability in OPSWAT's legitimate security driver to escalate privileges from user mode to kernel mode. OPSWAT is a widely deployed endpoint security and compliance solution used across government and enterprise networks. The vulnerable driver component processes unvalidated input from user-space applications, creating a kernel information disclosure flaw that attackers chain with privilege escalation techniques.
With kernel-level access, the malware disables Windows Defender, third-party antivirus engines, and behavioral detection systems. This neutralization removes the primary security barrier protecting the host. Attackers then install the full Spark RAT payload without interference from security software.
Spark RAT's functionality includes reverse shell access, allowing attackers to execute arbitrary commands with system privileges. The trojan can exfiltrate files, harvest credentials, enumerate network resources, and maintain persistent access through scheduled tasks or registry modifications. Its modular architecture supports plugin loading, enabling attackers to extend capabilities post-compromise.
The campaign targets government employees, healthcare workers, real estate professionals, and general business users in Cambodia. Organizations in these sectors face elevated risk. Attackers likely seek intelligence collection, financial fraud, or network access for espionage purposes. The geographic focus suggests possible involvement by state-sponsored or state-aligned threat actors with regional interests.
The OPSWAT driver vulnerability (which Acronis credits to OPSWAT's disclosure process) affects systems running older versions of the software. Organizations using patched or current OPSWAT installations face lower risk, though the broader exploitation pattern demonstrates attackers' systematic approach to circumventing modern defenses.
Defenders should prioritize patching OPSWAT to the latest version immediately. Email security controls should flag suspicious attachments and links, particularly those mimicking government communications or targeting sector-specific interests. Endpoint detection and response (EDR) solutions with kernel-level monitoring can detect privilege escalation attempts and unauthorized driver loading. Network monitoring for outbound connections to known command-and-control infrastructure provides additional protection.
The use of legitimate, vulnerable drivers for privilege escalation represents an established attack pattern. Spark RAT's accessibility as open-source code combined with this exploitation technique lowers barriers to entry for regional threat actors, likely expanding campaign scope beyond Cambodia over time.