Spark
Spark is a threat actor group, tracked by Brandefense. It targets organisations in Cambodia.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About Spark.
The Spark backdoor allows the attackers to: • Collect information about the infected machine. • Encrypt the collected data and send it to the attackers over the HTTP protocol. • Download additional payloads. • Log keystrokes. • Record audio using the computer’s microphone. • Execute commands on the infected machine. The creators of the Spark backdoor use a few techniques that are intended to keep the backdoor under-the-radar, including: • Packing the payloads with the Enigma packer. • Checking for antivirus and other security products using WMI. • Validating Arabic keyboard and language settings on the infected machine.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.