Threat reportMalwareTL-2026-0961
SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign
SharkLoader Malware Deploys Cobalt Strike Beacon via DLL (TL-2026-0961), also tracked as StrikeShark, is a high-severity malware campaign, first published 2026-06-27. It has no confirmed attribution, affects Microsoft Exchange Server, references 13 CVEs (CVE-2021-26855, CVE-2023-32315, CVE-2024-36401), maps to 33 MITRE ATT&CK techniques (T1003, T1005, T1010), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 13Referenced vulnerabilities
- Techniques
- 33MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-0961
- Threat ID
- TL-2026-0961
- Also known as
- StrikeShark, SharkLoader Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomatic, software-development
- Target regions
- Asia, Middle East, Latin America, Europe
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
Malware and tooling: Cobalt Strike Beacon, SharkLoader, FScan, Pillager, Procdump64.exe, Searchall, SharpGPOAbuse
How SharkLoader Malware Deploys Cobalt Strike Beacon via DLL works
A previously undocumented loader malware dubbed SharkLoader, tracked by Kaspersky GReAT as the StrikeShark campaign, deploys Cobalt Strike Beacon against diplomatic missions, government agencies, and software development firms across nine countries in Asia, the Middle East, and Latin America. The loader exploits a 'Perfect DLL Hijacking' technique via Windows Loader Lock escape to reflectively load Blowfish- and AES-encrypted payloads entirely in-memory, installs 30+ API hooks via Microsoft Detours to suppress ETW logging and evade behavioral sandboxes, and leverages thirteen public CVEs — spanning Microsoft Exchange, Fortinet, Cisco, Hikvision, GeoServer, and more — for initial access. Attribution points to a likely Chinese-speaking unidentified threat actor based solely on the Chinese-language open-source post-exploitation tooling used (FScan, Pillager, Searchall, SharpGPOAbuse) with no confirmed link to any tracked APT group.
The StrikeShark campaign, documented by Kaspersky's Global Research and Analysis Team (GReAT) in June 2026, centers on a custom-developed loader named SharkLoader. Initial discovery occurred during an incident response investigation of a compromised diplomatic organization in Indonesia; subsequent analysis expanded confirmed victims to nine countries: Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. Targeted sectors include government agencies, diplomatic missions, and software development companies, consistent with an espionage-motivated operator.
SharkLoader's infection chain begins with exploitation of unpatched internet-facing services. The campaign uses at least thirteen distinct CVEs for initial access, covering a broad range of enterprise products: Microsoft Exchange (ProxyLogon CVE-2021-26855, ProxyNotShell CVE-2022-41082, SharePoint CVE-2021-27076), Fortinet FortiOS (CVE-2022-40684, CVE-2024-21762), Cisco IOS XE (CVE-2023-20198), F5 BIG-IP (CVE-2023-46747), Hikvision cameras (CVE-2021-36260), Zimbra (CVE-2022-27925), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Apache Shiro (CVE-2016-4437), and React Server Components (CVE-2025-55182). Publicly available PoC exploit code exists for all thirteen vulnerabilities. In addition to CVE exploitation, the threat actor uses custom dropper executables masquerading as legitimate software installers — notably a fake Cisco AnyConnect VPN installer (extracting to %APPDATA%\reports\AnyConnect-win-4.msi), fake Google Update packages, and decoy PDF documents (engineering blueprints, biological treatment guides) — to deliver SharkLoader in phishing scenarios.
SharkLoader's core evasion technique is 'Perfect DLL Hijacking,' exploiting the Windows DLL Loader Lock. The malicious SystemSettings.dll is sideloaded by the legitimate Windows binary SystemSettings.exe (copied from C:\Windows\ImmersiveControlPanel\). During DllMain execution — normally restricted by the Loader Lock from calling most APIs — SharkLoader employs a Loader Lock escape mechanism to safely spawn threads and execute its full payload decryption and injection logic. The loader decrypts two encrypted modules from disk: DscCoreR.mui (Cobalt Strike Beacon bundled with MinHook, encrypted with Blowfish ECB using a 16-byte key embedded in the file header with custom P-array and S-box constants) and SyncRes.dat (API hook installer compiled against Microsoft Detours, encrypted with AES-128 where the first 16 bytes are the key and bytes 17-32 are the IV). Both modules are decrypted and reflectively loaded entirely in-memory, leaving no Cobalt Strike binary on disk.
SyncRes.dat installs hooks on over 30 Windows API functions including VirtualAlloc, Sleep, EtwEventWrite, CreateProcessA/W, WriteProcessMemory, NtCreateUserProcess, NtCreateThread, NtCreateThreadEx, NtQueueApcThread, VirtualAllocEx, VirtualProtect, VirtualProtectEx, ResumeThread, GetThreadContext, GetModuleHandleA/W, GetProcAddress, LoadLibraryA, OpenProcess, OpenProcessToken, AdjustTokenPrivileges, and OpenThread. The VirtualAlloc and Sleep hooks defeat timing-based memory scanner heuristics, while the EtwEventWrite hook suppresses ETW event logging to blind endpoint detection tools. jitasm-based syscall-level redirections provide an additional layer of behavioral evasion. Cobalt Strike Beacon is injected into a suspended thread with Parent Process ID (PPID) spoofing to masquerade as svchost.exe, and execution is withheld until all hooks are active.
Persistence is achieved via three scheduled tasks and a registry Run key. Scheduled task 1 ('OneDrive Standalone Update Task-S-1-5-21-4165425321-4153752593-2322023643-1000') triggers every five minutes for long-term persistence; task 2 ('MicrosoftUpdateTaskUserS-1-5-32-2456537112-101246289-228944324-1000') fires every second immediately post-deployment and self-removes; task 3 ('\Microsoft\Windows\Edge\Edgeupdate') runs daily. The registry Run key (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value 'MFUpdate') executes SystemSettings.exe from %APPDATA%\Identities\. Alternative sideloading host binaries observed include msedge.dll, PrintDialog.dll, and miracastview.dll, and alternative encrypted module filenames include GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls, suggesting modular payload-swapping capability.
Post-exploitation activity follows standard red team patterns mediated by Cobalt Strike Beacon. Credential theft uses LSASS memory dumping via Procdump64.exe and NTDS database extraction for offline Active Directory credential cracking. Network reconnaissance employs FScan (Chinese open-source port scanner). Information gathering uses Searchall and Pillager (Chinese open-source recon frameworks). Lateral movement leverages SharpGPOAbuse to modify Group Policy Objects for privilege escalation and persistence propagation. No confirmed data exfiltration was observed, consistent with espionage intelligence collection goals. C2 infrastructure uses Microsoft-themed domains: connect-microsoft.com, ms-record.com, ms-record.top, and ms-tray.top.
Attribution confidence is LOW. The exclusive use of Chinese-language open-source post-exploitation tooling (FScan, Pillager, Searchall, SharpGPOAbuse — all sourced from Chinese GitHub repositories) suggests a Chinese-speaking operator, but there is no code reuse, infrastructure overlap, or TTP fingerprint matching any tracked APT cluster. The threat actor does not match the profiles of APT10, APT41, APT40, or other known Chinese-attributed groups.
MITRE ATT&CK techniques used in TL-2026-0961
Credential Access
Collection
Discovery
T1010 Application Window Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules
Command and Control
T1071 Application Layer Protocol; T1568 Dynamic Resolution; T1573 Encrypted Channel
Privilege Escalation
T1134 Access Token Manipulation; T1484 Domain or Tenant Policy Modification
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
T1590 Gather Victim Network Information; T1595 Active Scanning
defense-impairment
Affected products and versions in SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
- Microsoft — Exchange Server
Vulnerable versions: 2013; 2016; 2019
Fixed in: 2019 CU8 with KB5000871 (ProxyLogon); 2019 CU12+ (ProxyNotShell) - Microsoft — SharePoint Server
Vulnerable versions: 2019; 2016; 2013
Fixed in: Apply KB5002099 - Fortinet — FortiOS
Vulnerable versions: 5.x-7.0.6; 7.2.0-7.2.1
Fixed in: 7.0.7+; 7.2.2+ - Fortinet — FortiOS SSL VPN
Vulnerable versions: 6.0.0-6.0.17; 6.2.0-6.2.15; 6.4.0-6.4.14; 7.0.0-7.0.13; 7.2.0-7.2.6; 7.4.0-7.4.2
Fixed in: 6.4.15+; 7.0.14+; 7.2.7+; 7.4.3+ - Cisco — IOS XE
Vulnerable versions: All IOS XE with HTTP/S server enabled
Fixed in: Apply Cisco Security Advisory patched builds - F5 — BIG-IP
Vulnerable versions: 13.1.0-13.1.5; 14.1.0-14.1.5; 15.1.0-15.1.8; 16.1.0-16.1.3; 17.1.0
Fixed in: 17.1.0.3+; 16.1.4+; 15.1.9+ - GeoSolutions — GeoServer
Vulnerable versions: 2.23.0-2.23.5; 2.24.0-2.24.3; 2.25.0-2.25.1
Fixed in: 2.23.6; 2.24.4; 2.25.2 - Hikvision — IP Camera Firmware
Vulnerable versions: Multiple firmware versions
Fixed in: Apply vendor-specific firmware update - Ignite Realtime — Openfire
Vulnerable versions: 3.10.0-4.7.4
Fixed in: 4.7.5+ - Synacor — Zimbra Collaboration Suite
Vulnerable versions: 8.8.15 Patch 31 and earlier; 9.0.0 Patch 24 and earlier
Fixed in: 8.8.15 Patch 32+; 9.0.0 Patch 25+
Remediation for SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
Patches
- Microsoft Exchange: Apply all cumulative updates addressing CVE-2021-26855 (ProxyLogon KB5000871) and CVE-2022-41082 (ProxyNotShell)
- Microsoft SharePoint: Apply patches for CVE-2021-27076
- Fortinet FortiOS: Upgrade to versions patching CVE-2022-40684 (7.0.7+, 7.2.2+) and CVE-2024-21762 (6.4.15+, 7.0.14+, 7.2.7+, 7.4.3+)
- Cisco IOS XE: Apply IOS XE Software Update addressing CVE-2023-20198
- F5 BIG-IP: Apply patches for CVE-2023-46747
- GeoServer: Upgrade to 2.23.6, 2.24.4, or 2.25.2+ (CVE-2024-36401)
- Hikvision: Apply firmware updates addressing CVE-2021-36260
- Openfire: Upgrade to 4.7.5 or later (CVE-2023-32315)
- Zimbra: Apply patches for CVE-2022-27925
- Apache Shiro: Upgrade to 1.2.5+ (CVE-2016-4437)
Immediate actions
- Block C2 domains at DNS/proxy layer: connect-microsoft.com, ms-record.com, ms-record.top, ms-tray.top
- Hunt for SharkLoader file indicators: SystemSettings.dll, DscCoreR.mui, SyncRes.dat, GameInputInboxs32.mui, Ignored.Dat, VistaCompat.nls, NtfsLog.etl in non-standard user directories
- Audit scheduled tasks matching names containing 'OneDrive Standalone Update Task' with unusual SIDs, 'MicrosoftUpdateTaskUser', or '\Microsoft\Windows\Edge\Edgeupdate' with unexpected triggers
- Check HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for 'MFUpdate' value pointing to %APPDATA%\Identities\SystemSettings.exe
- Scan for Cobalt Strike Beacon artifacts in memory using tools such as BeaconHunter or Volatility
- Apply emergency patches for actively exploited CVEs: CVE-2021-26855, CVE-2022-41082, CVE-2024-21762, CVE-2023-20198, CVE-2023-46747, CVE-2024-36401
- Identify and isolate systems with Procdump64.exe or FScan execution artifacts
- Block MD5 hashes: 9C872A0D5D5A38950E8B9AC9B488BE3F, AA3086BE652C8B20B0B29B2730D57119, A514D1BB62D7916475946FE7C07AC0AA, 9CBD560F820C95D7C38342CD558CB5C6 on endpoint controls
Workarounds
- Disable or restrict access to internet-facing Exchange, SharePoint, Zimbra, and Fortinet admin interfaces until patched
- Implement WAF rules for GeoServer and Openfire exploitation payloads
- Restrict PPID spoofing via Windows Defender Exploit Guard process mitigations
- Enable Credential Guard to protect LSASS memory from dumping
- Deploy Protected Process Light (PPL) for LSASS
- Monitor and alert on DLL loads from user-writable directories (e.g., %APPDATA%)
Longer-term hardening
- Deploy EDR with Cobalt Strike Beacon memory signature detection and reflective loading behavioral rules
- Enable ETW-based detection pipelines (Microsoft-Windows-Threat-Intelligence provider) and alert on EtwEventWrite hook installation attempts
- Implement application allowlisting to prevent sideloading of unauthorized DLLs alongside legitimate Windows binaries
- Audit and restrict internet-facing services; enforce patch SLA < 30 days for CVEs with public PoC
- Conduct threat hunt for FScan, SharpGPOAbuse, Pillager, and Searchall artifacts across endpoint telemetry
- Monitor LSASS access events (Event ID 4656 / 10 Sysmon) and restrict Procdump64.exe execution via ASR rules or allowlisting
- Implement Group Policy change auditing (Event ID 5136) to detect SharpGPOAbuse-style modifications
- Segment diplomatic and government network zones from internet-facing services
- Deploy network detection for Cobalt Strike malleable C2 profiles and ms-themed domain lookalikes
CVEs associated with SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
Weaknesses (CWE) in SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
Timeline of SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
- CVE-2016-4437 disclosed in Apache Shiro 1.2.4 and earlier — a Java deserialization vulnerability allowing authentication bypass. StrikeShark operators later included this 10-year-old CVE in their multi-exploit initial access toolkit, demonstrating persistent targeting of unpatched legacy infrastructure.
- Microsoft discloses CVE-2021-26855 (ProxyLogon), a critical SSRF vulnerability in Microsoft Exchange Server that enables pre-authentication remote code execution. CISA adds it to KEV; mass exploitation begins immediately. StrikeShark uses this against the initial Indonesian diplomatic mission target.
- GTSC researchers disclose CVE-2022-41082 (ProxyNotShell) affecting Microsoft Exchange Server, allowing authenticated RCE. Microsoft issues mitigations and later patches. The vulnerability is incorporated into StrikeShark's multi-CVE initial access arsenal targeting Exchange infrastructure.
- Fortinet discloses CVE-2022-40684, a critical authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager that allows unauthenticated admin access via crafted HTTP/HTTPS requests. Incorporated into StrikeShark initial access toolkit for targeting organizations with internet-exposed Fortinet appliances.
- Cisco discloses CVE-2023-20198, a zero-day privilege escalation vulnerability in the IOS XE Web UI actively exploited in the wild. Over 40,000 devices were compromised in days. SharkLoader operators incorporated this CVE into their initial access playbook for government and enterprise network targets.
- Fortinet discloses CVE-2024-21762, an out-of-bounds write vulnerability in FortiOS SSL VPN enabling unauthenticated remote code execution. CISA adds to KEV. Incorporated by StrikeShark operators for initial access to VPN-gateway-protected environments, particularly government networks.
- CVE-2024-36401 disclosed in GeoServer, a critical unauthenticated RCE vulnerability via OGC filter evaluation using property name expressions. CISA adds to KEV. StrikeShark operators use this against a Colombian organization — demonstrating active CVE-to-campaign operationalization within the same year as disclosure.
- Earliest estimated date of the StrikeShark campaign's initial compromise — a diplomatic mission in Indonesia targeted via CVE-2021-26855 (ProxyLogon). Kaspersky GReAT discovers the intrusion during incident response and begins analyzing SharkLoader, the previously undocumented loader used to deploy Cobalt Strike Beacon.
- Campaign expands to Taiwan, with government agencies and software development firms compromised via CVE-2023-32315 (Openfire path traversal). Kaspersky's analysis of the Taiwanese intrusion reveals shared SharkLoader infrastructure and identical C2 domains, confirming a unified threat actor behind multi-country targeting.
- StrikeShark operators compromise a Colombian organization via CVE-2024-36401 (GeoServer RCE). This intrusion expands the campaign's geographic footprint into Latin America and demonstrates the actor's capability to operationalize recent CVEs rapidly. SharkLoader artifacts with identical encryption keys and C2 domains confirmed.
- Campaign confirmed in Hong Kong, Lebanon, Syria, North Macedonia, Nepal, and Serbia simultaneously. Victims include additional diplomatic missions, government agencies, and software development companies. Post-exploitation tooling (FScan, SharpGPOAbuse, Pillager) used uniformly across all victim environments, confirming single threat actor.
- Kaspersky GReAT publishes 'StrikeShark: A New Campaign Involving a Custom SharkLoader and Cobalt Strike Beacon' on Securelist. Report discloses 9 victim countries, 13 exploited CVEs, full technical analysis of SharkLoader's Loader Lock escape mechanism, API hooking via Microsoft Detours, Blowfish/AES encryption, and C2 domain infrastructure. MD5 hashes for 9 malware samples released.
- CVE-2025-55182 in React Server Components confirmed as one of the 13 initial access CVEs used by StrikeShark, targeting software development firms with internet-exposed React SSR deployments — the newest CVE in the actor's arsenal and the only one targeting web application framework infrastructure.
- The Hacker News, Help Net Security, GBHackers, and CyberPress report on the StrikeShark campaign following the Kaspersky disclosure. Public IOCs (C2 domains, MD5 hashes) are widely distributed. Threat intel teams globally begin hunting for SharkLoader artifacts and blocking C2 domains. Campaign status remains ACTIVE with no confirmed actor takedown.
- TL-Intel-Harness documents TL-2026-0961, producing detection logic (SPL/KQL/Sigma) and simulation scenarios for SharkLoader and the StrikeShark campaign to enable proactive threat hunting and detection validation across SOC environments targeting the campaign's IOCs, behavioral patterns, and exploitation activity.
Sources cited for SharkLoader Malware Deploys Cobalt Strike Beacon via DLL
- StrikeShark: A New Campaign Involving a Custom SharkLoader and Cobalt Strike Beacon
- New SharkLoader Malware Deploys Cobalt Strike via DLL Side-Loading in StrikeShark Cyberattacks
- Kaspersky Warns of a New StrikeShark Campaign Targeting Organizations in Asia, Latin America, and Europe
- StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon
- Mystery Hackers Use Novel SharkLoader Dropper Against Governments, Software Devs
- New SharkLoader Malware Targets Diplomatic and Government Entities Across Multiple Countries
- CVE-2021-26855 NVD Detail — Microsoft Exchange ProxyLogon SSRF
- CVE-2024-21762 NVD Detail — Fortinet FortiOS SSL VPN Out-of-Bounds Write
- CVE-2024-36401 NVD Detail — GeoServer OGC Filter Evaluation RCE
- CVE-2023-20198 NVD Detail — Cisco IOS XE Web UI Privilege Escalation
- CVE-2023-46747 NVD Detail — F5 BIG-IP Authentication Bypass
- CISA KEV — CVE-2021-26855 Microsoft Exchange Server SSRF Known Exploited
- Kaspersky GReAT MalwareTips Forum — Investigate StrikeShark Campaign
Detection coverage for TL-2026-0961
As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0961 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.