An installer dressed up as a Cambodian government notice about COVID-19 prevention has been switching off victims' antivirus and then handing their machines to a remote operator. Darrel Virtusio and Subhajeet Singha of Acronis' Threat Research Unit published the analysis on 26 August 2026, after pulling apart archives aimed at people and organizations in Cambodia.
The lures are ordinary paperwork: government notices, public health announcements, dental records and real estate documents. Acronis says the file names are the main basis for calling the activity Cambodia-focused, and it found similar samples in the wild from late June through early August. It was also flagged in SentinelOne's weekly threat roundup.
A signed Tencent app opens the door
The archive holds an Inno Setup installer named "Cambodian Government Notice on COVID-19 Prevention and Control (July 7).docx.exe". Running it creates a hidden C:\Drivers folder and drops a legitimate, signed Tencent executable next to a malicious DLL, which Windows loads because the trusted program asks for it by name, a trick called DLL sideloading.
The loader hides its later stages inside genuine PNG images, decrypting each payload out of the image data so nothing recognizable sits on disk. It checks timing for analysis sandboxes first, then hunts for Huorong Internet Security, a Chinese antivirus product. Strings recovered by Acronis include "huorong detected, blinding" and "stripping privileges".
Kernel powers borrowed from a broken driver
The centre of the campaign is a bring your own vulnerable driver attack: the malware installs ardrv.sys, a legitimate but flawed driver shipped with OPSWAT AppRemover, purely to reach the Windows kernel. The recovered version is affected by CVE-2026-36425, which Acronis describes as an IOCTL handler, 0x2420031, that accepts process-termination requests from any local user without checking privileges. The researchers watched the malware call that handler and successfully kill processes.
The hard-coded kill list covers Microsoft Defender (MsMpEng.exe, MpDefenderCoreService.exe, NisSrv.exe), Huorong, Tencent PC Manager and 360 Total Security, and a second payload repeats the job in user mode. The same stage patches AMSI and ETW, the interfaces Windows uses to let security tools inspect and log activity, and adds Defender exclusions for C:\Drivers, VSSVC.exe and ctfmon.exe.
The final payload is SparkRAT, an open-source remote access trojan written in Go and released in 2022, loaded into memory inside the legitimate ctfmon.exe process. Its configuration points at sx[.]nuihuw[.]com on port 443, with nuihuw[.]top as a backup. Persistence is doubled up: a Windows service and a scheduled task, both named TaskHandler.
It looks like Silver Fox, and Acronis will not say it is
The tradecraft overlaps with campaigns reported under the Silver Fox name, and payload strings reference zam64 and BootRepair.sys, drivers named in earlier Cato Networks and Check Point Research work. But Acronis found no shared infrastructure, no code reuse and no matching certificates, and this cluster deploys SparkRAT rather than the ValleyRAT or Winos payloads usually tied to Silver Fox. It tracks the activity as an unattributed cluster with possible Chinese-language development links, assessed at low confidence. We covered a separate Silver Fox operation that used a Microsoft-signed driver to disable security software in Japan in June; Cambodia has so far been a quiet entry in our country threat profile.
Block the driver, then hunt for TaskHandler
There is no patch to apply here: nothing on the victim's machine was vulnerable to begin with. Block ardrv.sys by hash where a blocklist allows it, and alert on the campaign's own footprints: a service and scheduled task called TaskHandler, a staging directory at C:\Drivers, and injection into vssvc.exe, ctfmon.exe and svchost.exe. Acronis published hashes for every stage.
The lesson is not the malware. It is that a signed, forgotten uninstaller driver was enough to turn off four antivirus products in kernel mode. Attackers do not need a Windows zero-day when a security vendor's own tooling will do the work for them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.