https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 02 Sep 2026 14:57:23 +0000 https://vulnerability.circl.lu/sighting/771b11d6-9aae-4b23-a9e2-3fc68f950eab/export {"uuid": "771b11d6-9aae-4b23-a9e2-3fc68f950eab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/hacks.gr/post/3muigwsjzrrnl", "content": "Emails disguised as Cambodian government notices and health records deliver Spark RAT.\n\nThe chain abuses CVE-2026-36425 in ardrv.sys to gain h\u2026\n\nhttps://en.hacks.gr/o-efialtis-ton-drivers-pos-oi-chaker-ekmetalleyontai-tin-opswat-gia-na-exoydeterosoyn-to-antivirus-soy/\n\n#SparkRAT #CVE202636425 #BYOVD", "creation_timestamp": "2026-09-01T22:13:15.116070Z"} {"uuid": "771b11d6-9aae-4b23-a9e2-3fc68f950eab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/hacks.gr/post/3muigwsjzrrnl", "content": "Emails disguised as Cambodian government notices and health records deliver Spark RAT.\n\nThe chain abuses CVE-2026-36425 in ardrv.sys to gain h\u2026\n\nhttps://en.hacks.gr/o-efialtis-ton-drivers-pos-oi-chaker-ekmetalleyontai-tin-opswat-gia-na-exoydeterosoyn-to-antivirus-soy/\n\n#SparkRAT #CVE202636425 #BYOVD", "creation_timestamp": "2026-09-01T22:13:15.116070Z"} https://vulnerability.circl.lu/sighting/771b11d6-9aae-4b23-a9e2-3fc68f950eab/export Tue, 01 Sep 2026 22:13:15 +0000 https://vulnerability.circl.lu/sighting/f7323fef-12be-4d29-8a8c-933e13d745d2/export {"uuid": "f7323fef-12be-4d29-8a8c-933e13d745d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "exploited", "source": "https://t.me/thehackernews/9904", "content": "\ud83d\udea8 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.\n\nThe campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.\n\nHow the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html", "creation_timestamp": "2026-08-28T00:00:46.242897Z"} {"uuid": "f7323fef-12be-4d29-8a8c-933e13d745d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "exploited", "source": "https://t.me/thehackernews/9904", "content": "\ud83d\udea8 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.\n\nThe campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.\n\nHow the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html", "creation_timestamp": "2026-08-28T00:00:46.242897Z"} https://vulnerability.circl.lu/sighting/f7323fef-12be-4d29-8a8c-933e13d745d2/export Fri, 28 Aug 2026 00:00:46 +0000 https://vulnerability.circl.lu/sighting/b725c1fa-ca4a-48d9-bd5a-f7652bdc271c/export {"uuid": "b725c1fa-ca4a-48d9-bd5a-f7652bdc271c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/captechgroup.com/post/3mu3cdtemvf2j", "content": "Attackers are loading a legitimate signed OPSWAT AppRemover driver (CVE-2026-36425) to kill Defender from the kernel, then dropping Spark RAT on a host with no working sensors. #infosec #cybersecurity", "creation_timestamp": "2026-08-27T16:46:27.534424Z"} {"uuid": "b725c1fa-ca4a-48d9-bd5a-f7652bdc271c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/captechgroup.com/post/3mu3cdtemvf2j", "content": "Attackers are loading a legitimate signed OPSWAT AppRemover driver (CVE-2026-36425) to kill Defender from the kernel, then dropping Spark RAT on a host with no working sensors. #infosec #cybersecurity", "creation_timestamp": "2026-08-27T16:46:27.534424Z"} https://vulnerability.circl.lu/sighting/b725c1fa-ca4a-48d9-bd5a-f7652bdc271c/export Thu, 27 Aug 2026 16:46:27 +0000 https://vulnerability.circl.lu/sighting/f77c62e0-fce1-4143-ba39-c9833174dbce/export {"uuid": "f77c62e0-fce1-4143-ba39-c9833174dbce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "exploited", "source": "https://t.me/thehackernews/9904", "content": "\ud83d\udea8 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.\n\nThe campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.\n\nHow the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html", "creation_timestamp": "2026-08-27T13:00:04.639999Z"} {"uuid": "f77c62e0-fce1-4143-ba39-c9833174dbce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "exploited", "source": "https://t.me/thehackernews/9904", "content": "\ud83d\udea8 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.\n\nThe campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.\n\nHow the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html", "creation_timestamp": "2026-08-27T13:00:04.639999Z"} https://vulnerability.circl.lu/sighting/f77c62e0-fce1-4143-ba39-c9833174dbce/export Thu, 27 Aug 2026 13:00:04 +0000 https://vulnerability.circl.lu/sighting/517602ed-d194-4e2b-9a38-eac45f065d54/export {"uuid": "517602ed-d194-4e2b-9a38-eac45f065d54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "published-proof-of-concept", "source": "Telegram/rpxQrde5C3QRNvZwgV3wnpJTDTukLKxeiiPOPNL_I7MqRI0", "content": "", "creation_timestamp": "2026-08-26T00:00:09.945480Z"} {"uuid": "517602ed-d194-4e2b-9a38-eac45f065d54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "published-proof-of-concept", "source": "Telegram/rpxQrde5C3QRNvZwgV3wnpJTDTukLKxeiiPOPNL_I7MqRI0", "content": "", "creation_timestamp": "2026-08-26T00:00:09.945480Z"} https://vulnerability.circl.lu/sighting/517602ed-d194-4e2b-9a38-eac45f065d54/export Wed, 26 Aug 2026 00:00:09 +0000 https://vulnerability.circl.lu/sighting/80e75663-a4ef-47be-8cbb-d1feda817df6/export {"uuid": "80e75663-a4ef-47be-8cbb-d1feda817df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "Telegram/rpxQrde5C3QRNvZwgV3wnpJTDTukLKxeiiPOPNL_I7MqRI0", "content": "", "creation_timestamp": "2026-08-25T17:00:03.933402Z"} {"uuid": "80e75663-a4ef-47be-8cbb-d1feda817df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "Telegram/rpxQrde5C3QRNvZwgV3wnpJTDTukLKxeiiPOPNL_I7MqRI0", "content": "", "creation_timestamp": "2026-08-25T17:00:03.933402Z"} https://vulnerability.circl.lu/sighting/80e75663-a4ef-47be-8cbb-d1feda817df6/export Tue, 25 Aug 2026 17:00:03 +0000 https://vulnerability.circl.lu/sighting/231d279b-c9cf-451b-a3a5-7e9d6f9e20e1/export {"uuid": "231d279b-c9cf-451b-a3a5-7e9d6f9e20e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mre5ysz2tc2a", "content": "Thursday\u2019s fuck up - This Time - again Windows - CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis: medium.com/@jehadbudagg...\n\nPoC: github.com/redteamfortr... #windows #driver #BYOVD #redteam #poc", "creation_timestamp": "2026-07-23T15:07:26.315370Z"} {"uuid": "231d279b-c9cf-451b-a3a5-7e9d6f9e20e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mre5ysz2tc2a", "content": "Thursday\u2019s fuck up - This Time - again Windows - CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis: medium.com/@jehadbudagg...\n\nPoC: github.com/redteamfortr... #windows #driver #BYOVD #redteam #poc", "creation_timestamp": "2026-07-23T15:07:26.315370Z"} https://vulnerability.circl.lu/sighting/231d279b-c9cf-451b-a3a5-7e9d6f9e20e1/export Thu, 23 Jul 2026 15:07:26 +0000 https://vulnerability.circl.lu/sighting/730ba6c4-cb8c-40d7-a752-9b94452fcb2c/export {"uuid": "730ba6c4-cb8c-40d7-a752-9b94452fcb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-22T00:00:34.672804Z"} {"uuid": "730ba6c4-cb8c-40d7-a752-9b94452fcb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-22T00:00:34.672804Z"} https://vulnerability.circl.lu/sighting/730ba6c4-cb8c-40d7-a752-9b94452fcb2c/export Wed, 22 Jul 2026 00:00:34 +0000 https://vulnerability.circl.lu/sighting/8e057afa-714e-4447-b264-78dc54aea91c/export {"uuid": "8e057afa-714e-4447-b264-78dc54aea91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-21T00:00:10.646984Z"} {"uuid": "8e057afa-714e-4447-b264-78dc54aea91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-21T00:00:10.646984Z"} https://vulnerability.circl.lu/sighting/8e057afa-714e-4447-b264-78dc54aea91c/export Tue, 21 Jul 2026 00:00:10 +0000 https://vulnerability.circl.lu/sighting/7c160a49-b1e3-472c-87f1-f96999f3c209/export {"uuid": "7c160a49-b1e3-472c-87f1-f96999f3c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-20T21:00:05.154001Z"} {"uuid": "7c160a49-b1e3-472c-87f1-f96999f3c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-20T21:00:05.154001Z"} https://vulnerability.circl.lu/sighting/7c160a49-b1e3-472c-87f1-f96999f3c209/export Mon, 20 Jul 2026 21:00:05 +0000