Spark RAT Targets Cambodia with Vulnerable Opswat Driver

A new attack wave targets Cambodian individuals and businesses with an open-source Remote Access Trojan (RAT) dubbed Spark RAT. The malware exploits a known vulnerability in the Opswat MetaDefender driver, allowing attackers to turn off existing security software on infected machines. This approach gives them a foothold inside networks where other defenses remain active but unpatched ¹.

Spark RAT’s delivery method uses diverse lure themes designed to appeal to many potential victims. Campaign samples include government notices, public health materials, real estate content, and other seemingly innocuous topics that can trick users into downloading malicious attachments or links. By mimicking legitimate communications, the attackers increase the likelihood of successful infection across a broad target set ¹.

The technique mirrors earlier supply-chain tactics; similar methods were employed in 2019 against ASUS Live Update utilities, which also abused outdated drivers to gain persistence within corporate environments.

Attackers use lateral movement once inside a network, exploiting any remaining security tools that have not been updated to counter such vulnerabilities. This pattern underscores why patching legacy components remains critical for protecting sensitive infrastructure ¹.

Security specialists advise that the Cambodian government should prioritize updating all software and hardware before deploying it on mission‑critical systems. Regularly applying patches to third‑party drivers like Opswat is essential because these components often become the weakest link in an otherwise robust security posture.

The open-source nature of Spark RAT means its code can be easily modified for different targets beyond Southeast Asia, making detection harder without behavioral analysis techniques such as anomaly scoring applied at runtime using machine learning algorithms trained over time against known malicious behaviors exhibiting persistence mechanisms such as process hollowing combined through reverse engineering efforts undertaken by threat researchers globally who share indicators across various platforms including MITRE ATT&CK matrices referencing specific TTPs (Tactics Techniques Procedures).

Similar supply-chain attacks are not new: Stuxnet infected Iranian nuclear centrifuges via USB drives in 2010, while Duqu trojan targeted U.S. utilities in 2011. These incidents illustrate how compromised legitimate software can serve as a vehicle for espionage or sabotage. The vulnerability lies not only with the driver itself but also with how organizations integrate third‑party components into their systems—a problem likely to persist despite increased awareness due to legacy dependencies. It's probable this isn't limited to Cambodia given its use of common lures like government notices.

The Spark RAT campaign demonstrates that even well-known vendors’ components remain susceptible if they fall behind on updates. Organizations worldwide must audit and secure all embedded drivers, especially those used within critical infrastructure, to prevent attackers from disabling existing defenses and gaining undetected access.