The important point for Windows shops is not SparkRAT’s name or Cambodia-specific document lures. It is the combination of a signed application for DLL sideloading, several memory-resident stages hidden in files presented as PNG images, and the vulnerable ardrv.sys driver associated with OPSWAT AppRemover. Acronis observed the malware using that driver to terminate processes belonging to Microsoft Defender, Huorong Internet Security, Tencent PC Manager, and 360 Total Security.
The driver flaw is tracked as CVE-2026-36425. NIST’s National Vulnerability Database confirms that ardrv.sys version 2017.10.02.1551 and earlier permits a local user to submit process-termination requests through IOCTL 0x2420031 without adequate privilege validation. In other words, the attackers do not need to defeat Defender’s detection logic first: if they can persuade a user to execute the initial file, they bring a legitimately built but insecure kernel driver to the host and use it to strip away the processes meant to stop the rest of the chain.
The campaign targets Cambodia, but its Windows tradecraft travels
Acronis says the campaign is focused on Cambodia rather than proving every victim is located there. Its assessment rests primarily on archive names and lure subjects: Cambodian government notices, COVID-19 prevention material, dental examination records, real-estate documents, and promotional offers. One analyzed file masqueraded as a Cambodian government COVID-19 notice while actually being an Inno Setup executable.
That distinction is important. Acronis did not obtain phishing-delivery telemetry, so email delivery remains an evidence-based inference from the archive format and social-engineering content, rather than a directly observed fact. But the initial-access method does not depend on a Cambodian victim environment. The same sequence can be repackaged around invoices, HR records, government forms, shipment notices, or documents exchanged with overseas offices.
For organizations supporting staff, suppliers, or subsidiaries in Southeast Asia, localized business documents in compressed archives deserve increased scrutiny. For everyone else, the campaign remains relevant because the Windows-side mechanics—running a disguised installer, signed-binary DLL sideloading, service creation, scheduled tasks, driver installation, and process injection—are portable across regions.
ardrv.sys turns an endpoint foothold into a defense-evasion problem
BYOVD attacks exploit a structural weakness in endpoint protection: Windows drivers operate in the kernel, and a vulnerable driver can offer an attacker capabilities far beyond those of an ordinary user-mode payload. In this case, Acronis observed the malware install ardrv.sys, communicate with it, invoke the vulnerable IOCTL, and terminate selected security processes.
The NVD record classifies CVE-2026-36425 as an improper-privilege-management issue and lists a CISA-assigned CVSS 3.1 score of 6.5. That numerical rating can understate its operational value to an intruder. The flaw requires local access, but this malware campaign’s installer is designed to supply precisely that foothold. Once the victim launches the file, the driver is used as an enabler for the higher-value objective: removing security controls before the remote-access payload takes hold.
Microsoft’s guidance separates two protections that administrators should not confuse. The Microsoft vulnerable driver blocklist is intended to stop known bad or vulnerable drivers from loading. The Microsoft Defender Attack Surface Reduction rule, Block abuse of exploited vulnerable signed drivers, is meant to prevent applications from writing vulnerable signed drivers to disk. Microsoft explicitly notes that the ASR rule alone does not prevent a vulnerable driver already present on a machine from loading; driver-load protection requires the vulnerable-driver blocklist or an App Control for Business policy.
That makes this a configuration audit, not merely an indicator-blocking exercise. Windows 11 devices should be checked to ensure the vulnerable driver blocklist has not been disabled. Microsoft says it is enabled by default on Windows 11 beginning with the 2022 Update, and it is enforced when Memory Integrity, Smart App Control, or S mode is active, with limited server exceptions. Organizations relying on Windows Server or older Windows deployments should not assume that the client default applies to them.
A signed Tencent executable is used as a loader, not proof of safety
Acronis describes an Inno Setup package that stages files in a hidden directory, then launches a signed Tencent executable to sideload a malicious DLL. Code-signing establishes that a specific file was signed by a publisher; it does not establish that every DLL loaded beside that executable is trustworthy. This campaign exploits exactly that boundary.
The loader performs an elapsed-time anti-sandbox check, decrypts shellcode from files formatted as PNGs, and injects it into vssvc.exe. It then monitors that process and reinjects code if the process exits or starts again with a new process ID. In its non-SYSTEM “setup” path, Acronis says the malware creates a service and a scheduled task named TaskHandler, configured to start under NT AUTHORITY\SYSTEM.
The campaign also attempts to patch AMSI and ETW-related functionality and configures Microsoft Defender exclusions for its chosen processes and directories, including C:\Drivers. These details show why a clean alert for one suspicious archive may not be the end of the incident. The infection chain is designed to establish multiple routes for survival: a service, a scheduled task, process injection, repeated injection into a monitored process, tampered scanning scope, and eventually a kernel-mode process-killing primitive.
Microsoft warns that exclusions create protection gaps and can affect malware detection as well as file and certificate indicators of compromise. Defender administrators should treat newly added exclusions for broad directories, system locations, or unusual processes as an investigation lead—especially where they coincide with vssvc.exe, ctfmon.exe, unexpected driver files, or a new TaskHandler service or task.
SparkRAT is the endpoint payload, not the full incident
The final payload is SparkRAT, a Go-based, cross-platform remote-access trojan. Acronis observed it loaded reflectively into a legitimate Windows process after the preceding stages had already performed persistence and defense impairment. The researchers also observed communication with an attacker-controlled server over TCP port 443, with a backup endpoint configured separately.
Port 443 is ordinary HTTPS territory, so a network rule that assumes all encrypted outbound traffic is benign will not identify this campaign. The more useful correlation is behavioral: a recently created scheduled task or service, followed by a signed executable loading an unusual DLL, then a driver installation, security-process termination, Defender exclusion changes, and outbound encrypted traffic from an unexpected process context.
Security teams should also avoid treating the PNG files as harmless merely because they carry image-like names or headers. In Acronis’s analysis, the files functioned as containers for encrypted shellcode. Microsoft’s own Defender guidance specifically cautions against broadly excluding .png files from scanning, alongside .sys, .zip, .rar, .exe, and other formats attackers can abuse.
What Windows administrators should check now
The research includes hashes, malicious filenames, domains, and process details, but the durable response is to hunt for the technique chain and close the policy gaps that make BYOVD effective.
- Verify that Microsoft’s vulnerable driver blocklist is enabled across Windows 11 fleets, and evaluate App Control for Business policies for managed endpoints where stronger driver enforcement is required. Test policy changes in audit mode before enforcing them because Microsoft warns that kernel-driver blocks can affect legitimate hardware or software.
- Enable and monitor the ASR rule that blocks abuse of exploited vulnerable signed drivers. It is a preventive layer against a dropped driver, but it should be paired with driver-load blocking rather than deployed as a substitute.
- Confirm that Defender tamper protection is centrally managed and active. Microsoft says tamper protection can block registry attempts to modify Defender settings; Intune-managed devices with the required configuration can also protect Defender exclusions from local tampering.
- Hunt for installations or loads of
ardrv.sys, especially version 2017.10.02.1551 and earlier, and investigate unexpected driver-service creation. Acronis’s finding that the driver can terminate security processes makes the presence of this legacy component worth validating even outside a known SparkRAT incident. - Review persistence for the service and scheduled task name
TaskHandler, and investigate unexpected launches involvingvssvc.exe,ctfmon.exe,svchost.exe, hidden staging folders, or a Tencent-signed executable loading DLLs from nonstandard directories. - Search endpoint and network telemetry for the indicators published by Acronis, but retain logs for Defender configuration changes, driver loads, service creation, scheduled-task creation, and process termination. Those records are the evidence that connects an isolated SparkRAT alert to the larger intrusion sequence.
Acronis found operational similarities to activity commonly associated with Silver Fox, including DLL sideloading, persistence, vulnerable-driver abuse, and security-product termination. It did not find shared infrastructure, distinct code reuse, matching certificates, or another actor-specific link sufficient to attribute this campaign to Silver Fox. The Chinese-language configuration value and targeting of Chinese-market security products support only a low-confidence assessment of a Chinese-language development or deployment environment.
That restraint should carry into defensive reporting. The confirmed risk is a Cambodia-focused Windows campaign that uses CVE-2026-36425 to impair endpoint defenses and deploy SparkRAT. The immediate operational consequence is clear: organizations that have left vulnerable-driver controls, Defender tamper protection, or exclusion governance unchecked are giving an attacker several opportunities to convert one executed lure into durable remote access.