Research highlights use of phishing with fake government communications leading to remote access with multi-stage techniques and abuse of vulnerable drivers to evade endpoint defenses
Acronis, global leader in the protection informatica via the team Acronis Threat Research Unit (TRU), identified a new cyber campaign aimed at individuals and organizations in Cambodia, characterized by a sophisticated multi-stage infection chain and the combined use of evasion, persistence and defense compromise techniques. The content references Cambodian government communications, public health data, dental exams, real estate documentation and promotional offers. The campaign combines the use of KickRAT, an open-source, cross-platform remote access Trojan written in Go and released publicly in 2022.
Acronis emphasizes that the evaluation on the target objectives is mainly based on the names of the archives and the contents used. The absence of complete telemetry on the victims does not allow us to determine with certainty the real extent of the campaign or the number of systems involved. Similar samples were observed from late June through early August, indicating activity that continued for several weeks.
A multi-stage infection chain with payloads hidden in PNG files
The attack starts from an Inno Setup installer contained in a compressed archive called: “Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe”. Once executed, the installer creates a hidden directory and stores subsequent components there. A significant feature of the campaign is the use of seemingly harmless files to hide additional malicious components. Before accessing the payload, the malware checks for the presence of processes belonging to Huorong Internet Security, an antivirus and endpoint security product developed in China.
Persistence and compromise of defenses with abuse of a vulnerable driver
The campaign implements several mechanisms to maintain access to the compromised system. The malware creates a Windows service and a scheduled task called TaskHandler and monitors vssvc.exe to re-inject after a reboot. Process injection moves execution into legitimate Windows processes, including vssvc.exe, ctfmon.exe, and svchost.exe, making it more difficult to distinguish malicious activity from normal system processes. One of the most relevant aspects of the campaign is the use of the Bring Your Own Vulnerable Driver (BYOVD) technique, which sees the distribution of a driver affected by the vulnerability CVE-2026-36425, a driver that is used to help terminate processes belonging to kernel-level security products.
SparkRAT at the end of the chain, similarities with SilverFox and connections with Chinese-speaking environments
The final step in the chain leads to the execution of SparkRAT, reflexively loaded inside a legitimate Windows process. The payload provides operators with remote access and control capabilities of the compromised system. The campaign has several similarities to activities previously associated with SilverFox. Common elements include sideloading DLLs through signed applications, multi-stage deployment, persistence through scheduled services and tasks, Microsoft Defender exclusions, process injection, and using vulnerable drivers to interfere with security products.
The SparkRAT configuration also contains a Chinese language value, and the malware targets several security products commonly used in Chinese environments. These elements are compatible with a possible Chinese-language development or distribution environment, but do not constitute proof of the operators' nationality or geographical location.
A threat that combines multiple levels of evasion and how to protect yourself
The campaign demonstrates how attackers are combining different techniques to progressively overcome security systems: from localized social engineering to DLL sideloading, from payloads hidden in PNG files to process injection, to the persistence and abuse of vulnerable drivers. Each phase performs a specific function: the installer prepares the environment, the loader launches the malicious code, PNG files hide the payloads, anti-sandbox controls hinder analysis, process injection masks execution and persistence mechanisms guarantee continuity of access. In parallel, the malware attempts to weaken defenses through privilege manipulation, changes to Microsoft Defender, interference with AMSI and ETW, and the BYOVD technique.
To reduce the risk of compromise, Acronis recommends that organizations regularly conduct security awareness activities to help users recognize phishing emails and suspicious attachments. It is also essential to adopt endpoint detection and response (EDR) solutions capable of detecting and blocking malicious activities such as DLL sideloading, process injection and defense evasion attempts. Security teams should monitor the unexpected creation of new services, scheduled tasks, and Microsoft Defender exclusions, which may indicate attempts to persist or weaken protections.
Acronis customers are protected: the campaign is detected and blocked by Acronis EDR/XDR.
