The malware distribution leverages a vulnerable OPSWAT driver to bypass security controls. This technique allows the attackers to disable endpoint protection tools on compromised machines, significantly increasing the difficulty of detection and response.

Key technical details from the campaign include:

• The payload is delivered via phishing lures tailored to Cambodian users.
• The exploit abuses a legitimate but vulnerable OPSWAT driver to gain kernel-level access.
• Once executed, Spark RAT provides attackers with remote control over the infected system.
• The malware is capable of evading security software by terminating or disabling its processes.

Organizations in the region should review their security stack for exposure to the vulnerable OPSWAT driver and monitor for unusual system behavior. Users are advised to avoid opening unsolicited attachments or links, particularly those masquerading as government or public service communications.

Source: The Hacker News

Has your security team already audited your endpoints for the presence of this vulnerable driver, and what steps are you taking to detect Spark RAT activity in your environment?