{"vulnerability": "CVE-2026-36425", "sightings": [{"uuid": "80e75663-a4ef-47be-8cbb-d1feda817df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "Telegram/rpxQrde5C3QRNvZwgV3wnpJTDTukLKxeiiPOPNL_I7MqRI0", "content": "", "creation_timestamp": "2026-08-25T17:00:03.933402Z"}, {"uuid": "f77c62e0-fce1-4143-ba39-c9833174dbce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "exploited", "source": "https://t.me/thehackernews/9904", "content": "\ud83d\udea8 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.\n\nThe campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.\n\nHow the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html", "creation_timestamp": "2026-08-27T13:00:04.639999Z"}, {"uuid": "7c160a49-b1e3-472c-87f1-f96999f3c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-20T21:00:05.154001Z"}, {"uuid": "8e057afa-714e-4447-b264-78dc54aea91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-21T00:00:10.646984Z"}, {"uuid": "f7323fef-12be-4d29-8a8c-933e13d745d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "exploited", "source": "https://t.me/thehackernews/9904", "content": "\ud83d\udea8 Spark RAT targets Cambodia using a vulnerable driver to kill security processes.\n\nThe campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT.\n\nHow the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html", "creation_timestamp": "2026-08-28T00:00:46.242897Z"}, {"uuid": "730ba6c4-cb8c-40d7-a752-9b94452fcb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/394", "content": "CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis", "creation_timestamp": "2026-07-22T00:00:34.672804Z"}, {"uuid": "231d279b-c9cf-451b-a3a5-7e9d6f9e20e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mre5ysz2tc2a", "content": "Thursday\u2019s fuck up - This Time - again Windows - CVE-2026-36425 aka Arbitrary Process termination (BYOVD)\n\nCVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory \n\nAnalysis: medium.com/@jehadbudagg...\n\nPoC: github.com/redteamfortr... #windows #driver #BYOVD #redteam #poc", "creation_timestamp": "2026-07-23T15:07:26.315370Z"}, {"uuid": "517602ed-d194-4e2b-9a38-eac45f065d54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "published-proof-of-concept", "source": "Telegram/rpxQrde5C3QRNvZwgV3wnpJTDTukLKxeiiPOPNL_I7MqRI0", "content": "", "creation_timestamp": "2026-08-26T00:00:09.945480Z"}, {"uuid": "b725c1fa-ca4a-48d9-bd5a-f7652bdc271c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36425", "type": "seen", "source": "https://bsky.app/profile/captechgroup.com/post/3mu3cdtemvf2j", "content": "Attackers are loading a legitimate signed OPSWAT AppRemover driver (CVE-2026-36425) to kill Defender from the kernel, then dropping Spark RAT on a host with no working sensors. #infosec #cybersecurity", "creation_timestamp": "2026-08-27T16:46:27.534424Z"}]}