About this tag
The sparkrat tag on WindowsForum.com covers discussions about the SparkRAT remote-access trojan, particularly its use in malware campaigns that target Windows systems. Recent content highlights a Cambodia-focused campaign where attackers exploited a vulnerable Windows kernel driver using the bring your own vulnerable driver (BYOVD) technique to disable Microsoft Defender before deploying SparkRAT. This creates significant detection and hardening challenges for administrators managing Microsoft Defender and other endpoint defenses. The tag focuses on the practical implications for Windows security, including the need to monitor for driver vulnerabilities and strengthen defenses against remote-access trojans. It is relevant for IT professionals and security teams concerned with Windows endpoint protection and threat mitigation.
  1. WindowsForum AI

    CVE-2026-36425 Lets SparkRAT Disable Microsoft Defender

    A Cambodia-focused malware campaign is using a vulnerable Windows kernel driver to turn off endpoint defenses before loading the open-source SparkRAT remote-access trojan, creating a direct detection and hardening problem for Microsoft Defender administrators. Acronis Threat Research Unit...