Spark RAT campaign hits Cambodia, using fake government and health notices as bait

Key points

• A campaign targeting people and organisations in Cambodia is spreading Spark RAT, an open-source remote access tool that lets attackers take over infected computers.
• Lures include fake government notices, public health materials and real estate content, according to Acronis researchers.
• The attackers abuse a vulnerable driver from security vendor OPSWAT to disable antivirus and other protections on infected machines.
• Spark RAT is freely available on code-sharing sites, which makes it hard to tie the activity to any single criminal group.
• No ransom demand has been reported in this campaign.

A fresh malware campaign is hitting computers in Cambodia, and the bait is designed to look boringly official.

Researchers at Acronis say the attackers are dropping Spark RAT, a remote access trojan. A remote access trojan, or RAT, quietly hands control of a victim's computer to someone else on the internet. Once installed, the attacker can read files, watch the screen, turn on the microphone and run further commands.

Spark RAT isn't a custom-built weapon. It's open-source, free to download, which is part of why it keeps turning up in separate criminal operations worldwide.

Who is being targeted?

People and organisations inside Cambodia. Acronis describes a spread of lures aimed at different kinds of victim rather than one specific industry.

The bait documents pose as government notices, public health materials or real estate listings. Casting wide like that suggests the attackers expect only a fraction of recipients to open the file. Cambodia has appeared in our coverage four times in the last 90 days, including OpenAI's August move against a Poipet-based scam ring that was drafting fraud scripts through ChatGPT, so the country's threat profile is clearly shifting.

How does the attack actually work?

A target opens what looks like a normal document and the malware installs quietly in the background. Spark RAT then phones home to an attacker-controlled server and waits for orders.

Before settling in, the intruders disable the computer's security software. They do this by abusing a vulnerable driver made by OPSWAT, a well-known security vendor. A driver is a small piece of code that talks directly to the operating system's core. Because drivers run with very high privileges, a flawed one can be turned into a skeleton key: the attackers load the trusted-but-buggy OPSWAT driver, then use its weakness to shut down antivirus tools that would otherwise raise the alarm.

This technique is called "bring your own vulnerable driver." Windows accepts the driver without complaint because it carries a legitimate signature. That's what makes it dangerous.

What is Spark RAT and who uses it?

Spark RAT is a free, cross-platform remote administration tool published on public code repositories, originally pitched as a legitimate admin utility. Criminal crews have adopted it because it's functional and simple to modify.

Attribution is genuinely difficult. Anyone from a lone operator to a state-linked group can pull the code, so pinning the Cambodia campaign on a single culprit isn't yet possible. Threat Vectr ran into similar attribution problems covering Cruciferra in July, where another open-source RAT was being packaged and sold as a service.

Should ordinary people worry?

If you live or work in Cambodia, treat unexpected documents with suspicion, especially anything claiming to come from a ministry or a property agent. Don't open attachments from senders you can't verify directly.

For security teams, the OPSWAT driver loading on machines where it has no legitimate role is the sharpest early signal that this attack chain is running. Hunt for that before anything else.