Executive Summary
Acronis TRU has identified a targeted campaign focusing on Cambodia, using localized lures such as government notices and public health announcements. The campaign employs a sophisticated multi-stage infection chain that begins with Inno Setup installers and progresses through DLL sideloading and process injection. Notably, the threat actor utilizes a 'Bring Your Own Vulnerable Driver' (BYOVD) technique, abusing CVE-2026-36425 in the ardrv.sys driver to impair security software.
Technically, the malware hides its encrypted stages within PNG file IDAT chunks and uses advanced defense impairment, including token manipulation and the patching of AMSI and ETW. The final payload is SparkRAT, an open-source remote access trojan, configured to communicate with Chinese-language metadata. While the tradecraft mirrors SilverFox-associated activity, definitive attribution is not possible due to a lack of shared infrastructure.
This campaign highlights the continued geopolitical focus on Southeast Asia and the evolution of defense-evasion tactics designed to bypass endpoint security products like 360 Total Security, Huorong, and Microsoft Defender.