Executive Summary
Cybersecurity researchers at Acronis and Sekoia have uncovered an advanced cyber espionage campaign active across Southeast Asia deploying Spark RAT. The operation stands out for its aggressive weaponization of the Bring Your Own Vulnerable Driver (BYOVD) technique. Threat actors are utilizing legitimately signed, vulnerable kernel drivers associated with OPSWAT endpoint compliance software to disable endpoint security agents, neutralize behavioral monitoring, and establish persistent covert surveillance on critical enterprise networks.
Deep-Dive Technical Analysis
The Bring Your Own Vulnerable Driver (BYOVD) attack pattern remains one of the most potent mechanisms for bypassing modern Windows security architectures, including Driver Signature Enforcement (DSE).
1. BYOVD Exploitation Chain
Threat actors who obtain administrative or elevated privileges cannot directly load unsigned rootkits due to mandatory 64-bit Windows Driver Signature Enforcement. To circumvent this barrier:
- Loading the Legitimate Driver: The Spark RAT dropper drops and loads an authentic, cryptographically signed OPSWAT kernel driver (`gekw.sys` / `opswat_driver.sys`) that possesses known, unpatched memory manipulation vulnerabilities.
- Exploiting Driver IOCTL Interfaces: The driver exposes exposed Input/Output Control (IOCTL) codes lacking adequate caller validation. The user-mode malware issues crafted IOCTL requests to the driver, instructing it to read and write arbitrary physical and virtual kernel memory addresses.
- Patching EDR Callbacks: The driver is instructed to nullify active `ObRegisterCallbacks` and process-creation notification routines registered by installed antivirus and EDR solutions, effectively blinding defensive software.
2. Spark RAT Architecture & Capabilities
With host defenses dismantled, the primary payload—Spark RAT—is unpacked into memory:
- Modular C2 Communication: Uses custom TLS-wrapped WebSocket channels communicating with geo-distributed command-and-control nodes.
- Extensive Surveillance Toolset: Features automated keystroke logging, microphone audio capture, desktop screenshot streaming, clipboard monitoring, and automated harvesting of browser SQLite credential databases.
- Memory-Only Execution: Employs process hollowing into legitimate Windows system processes (`svchost.exe`, `explorer.exe`) to minimize disk forensics footprint.
Industry Impact & Mitigation Strategies
The ongoing weaponization of legitimate enterprise drivers underscores the necessity of proactively maintaining kernel driver blocklists and restricting driver installation privileges.
Actionable Defense Recommendations:
1. Deploy Microsoft Recommended Driver Block Rules: Ensure Windows Defender Application Control (WDAC) and the Microsoft Vulnerable Driver Blocklist are strictly enforced and updated across all enterprise endpoints.
2. Restrict Kernel Driver Loading: Implement strict group policies and AppLocker rules preventing non-administrative service accounts from registering new kernel service binaries.
3. Audit Installed Third-Party Endpoint Utilities: Verify that all installed compliance, monitoring, and utility software drivers are running current, patched versions with deprecated legacy drivers completely purged.