Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics," Acronis Threat

Report facts: The article describes a campaign in Cambodia delivering Spark RAT, an open-source remote access trojan, using varied social engineering lures such as government notices, public health materials, and real-estate themed content to compromise individuals and organizations. The focus is on traditional malware delivery and abuse of a vulnerable OPSWAT driver to disable security tools, not on AI models or agents. RealGround analysis: While Spark RAT itself is not reported as AI-driven, organizations using AI systems could be indirectly affected if compromised endpoints are used to steal data, credentials, or later deploy AI-powered tooling. Strengthening overall security posture and incident readiness helps reduce the chance that endpoint compromises evolve into broader data leakage or malicious AI use scenarios.