# SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign

> A previously undocumented loader malware dubbed SharkLoader, tracked by Kaspersky GReAT as the StrikeShark campaign, deploys Cobalt Strike Beacon against diplomatic missions, government agencies, and software development firms across nine countries in Asia, the Middle East, and Latin America. The loader exploits a 'Perfect DLL Hijacking' technique via Windows Loader Lock escape to reflectively load Blowfish- and AES-encrypted payloads entirely in-memory, installs 30+ API hooks via Microsoft Detours to suppress ETW logging and evade behavioral sandboxes, and leverages thirteen public CVEs — spanning Microsoft Exchange, Fortinet, Cisco, Hikvision, GeoServer, and more — for initial access. Attribution points to a likely Chinese-speaking unidentified threat actor based solely on the Chinese-language open-source post-exploitation tooling used (FScan, Pillager, Searchall, SharpGPOAbuse) with no confirmed link to any tracked APT group.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-06-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0961
- **ID:** TL-2026-0961
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2023-32315, CVE-2024-36401, CVE-2016-4437, CVE-2021-36260, CVE-2021-27076, CVE-2022-27925, CVE-2022-41082, CVE-2023-46747, CVE-2024-21762, CVE-2025-55182, CVE-2022-40684, CVE-2023-20198

## Description

The StrikeShark campaign, documented by Kaspersky's Global Research and Analysis Team (GReAT) in June 2026, centers on a custom-developed loader named SharkLoader. Initial discovery occurred during an incident response investigation of a compromised diplomatic organization in Indonesia; subsequent analysis expanded confirmed victims to nine countries: Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. Targeted sectors include government agencies, diplomatic missions, and software development companies, consistent with an espionage-motivated operator.

SharkLoader's infection chain begins with exploitation of unpatched internet-facing services. The campaign uses at least thirteen distinct CVEs for initial access, covering a broad range of enterprise products: Microsoft Exchange (ProxyLogon CVE-2021-26855, ProxyNotShell CVE-2022-41082, SharePoint CVE-2021-27076), Fortinet FortiOS (CVE-2022-40684, CVE-2024-21762), Cisco IOS XE (CVE-2023-20198), F5 BIG-IP (CVE-2023-46747), Hikvision cameras (CVE-2021-36260), Zimbra (CVE-2022-27925), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Apache Shiro (CVE-2016-4437), and React Server Components (CVE-2025-55182). Publicly available PoC exploit code exists for all thirteen vulnerabilities. In addition to CVE exploitation, the threat actor uses custom dropper executables masquerading as legitimate software installers — notably a fake Cisco AnyConnect VPN installer (extracting to %APPDATA%\reports\AnyConnect-win-4.msi), fake Google Update packages, and decoy PDF documents (engineering blueprints, biological treatment guides) — to deliver SharkLoader in phishing scenarios.

SharkLoader's core evasion technique is 'Perfect DLL Hijacking,' exploiting the Windows DLL Loader Lock. The malicious SystemSettings.dll is sideloaded by the legitimate Windows binary SystemSettings.exe (copied from C:\Windows\ImmersiveControlPanel\). During DllMain execution — normally restricted by the Loader Lock from calling most APIs — SharkLoader employs a Loader Lock escape mechanism to safely spawn threads and execute its full payload decryption and injection logic. The loader decrypts two encrypted modules from disk: DscCoreR.mui (Cobalt Strike Beacon bundled with MinHook, encrypted with Blowfish ECB using a 16-byte key embedded in the file header with custom P-array and S-box constants) and SyncRes.dat (API hook installer compiled against Microsoft Detours, encrypted with AES-128 where the first 16 bytes are the key and bytes 17-32 are the IV). Both modules are decrypted and reflectively loaded entirely in-memory, leaving no Cobalt Strike binary on disk.

SyncRes.dat installs hooks on over 30 Windows API functions including VirtualAlloc, Sleep, EtwEventWrite, CreateProcessA/W, WriteProcessMemory, NtCreateUserProcess, NtCreateThread, NtCreateThreadEx, NtQueueApcThread, VirtualAllocEx, VirtualProtect, VirtualProtectEx, ResumeThread, GetThreadContext, GetModuleHandleA/W, GetProcAddress, LoadLibraryA, OpenProcess, OpenProcessToken, AdjustTokenPrivileges, and OpenThread. The VirtualAlloc and Sleep hooks defeat timing-based memory scanner heuristics, while the EtwEventWrite hook suppresses ETW event logging to blind endpoint detection tools. jitasm-based syscall-level redirections provide an additional layer of behavioral evasion. Cobalt Strike Beacon is injected into a suspended thread with Parent Process ID (PPID) spoofing to masquerade as svchost.exe, and execution is withheld until all hooks are active.

Persistence is achieved via three scheduled tasks and a registry Run key. Scheduled task 1 ('OneDrive Standalone Update Task-S-1-5-21-4165425321-4153752593-2322023643-1000') triggers every five minutes for long-term persistence; task 2 ('MicrosoftUpdateTaskUserS-1-5-32-2456537112-101246289-228944324-1000') fires every second immediately post-deployment and self-removes; task 3 ('\Microsoft\Windows\Edge\Edgeupdate') runs daily. The registry Run key (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value 'MFUpdate') executes SystemSettings.exe from %APPDATA%\Identities\. Alternative sideloading host binaries observed include msedge.dll, PrintDialog.dll, and miracastview.dll, and alternative encrypted module filenames include GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls, suggesting modular payload-swapping capability.

Post-exploitation activity follows standard red team patterns mediated by Cobalt Strike Beacon. Credential theft uses LSASS memory dumping via Procdump64.exe and NTDS database extraction for offline Active Directory credential cracking. Network reconnaissance employs FScan (Chinese open-source port scanner). Information gathering uses Searchall and Pillager (Chinese open-source recon frameworks). Lateral movement leverages SharpGPOAbuse to modify Group Policy Objects for privilege escalation and persistence propagation. No confirmed data exfiltration was observed, consistent with espionage intelligence collection goals. C2 infrastructure uses Microsoft-themed domains: connect-microsoft.com, ms-record.com, ms-record.top, and ms-tray.top.

Attribution confidence is LOW. The exclusive use of Chinese-language open-source post-exploitation tooling (FScan, Pillager, Searchall, SharpGPOAbuse — all sourced from Chinese GitHub repositories) suggests a Chinese-speaking operator, but there is no code reuse, infrastructure overlap, or TTP fingerprint matching any tracked APT cluster. The threat actor does not match the profiles of APT10, APT41, APT40, or other known Chinese-attributed groups.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1106 Native API
- T1129 Shared Modules
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1134 Access Token Manipulation
- T1484 Domain or Tenant Policy Modification
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1055 Process Injection
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1033 System Owner/User Discovery
- T1010 Application Window Discovery
- T1018 Remote System Discovery
- T1069 Permission Groups Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1568 Dynamic Resolution

## Sources

- [StrikeShark: A New Campaign Involving a Custom SharkLoader and Cobalt Strike Beacon](https://securelist.com/strikeshark-campaign/120326/)
- [New SharkLoader Malware Deploys Cobalt Strike via DLL Side-Loading in StrikeShark Cyberattacks](https://thehackernews.com/2026/06/new-sharkloader-malware-deploys-cobalt.html)
- [Kaspersky Warns of a New StrikeShark Campaign Targeting Organizations in Asia, Latin America, and Europe](https://www.kaspersky.com/about/press-releases/kaspersky-warns-of-a-new-strikeshark-campaign-targeting-organizations-in-asia-latin-america-and-europe-with-advanced-malware)
- [StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon](https://gbhackers.com/sharkloader-malware-to-deploy-cobalt-strike/)
- [Mystery Hackers Use Novel SharkLoader Dropper Against Governments, Software Devs](https://www.helpnetsecurity.com/2026/06/26/sharkloader-dropper-governments-software-developers/)
- [New SharkLoader Malware Targets Diplomatic and Government Entities Across Multiple Countries](https://cyberpress.org/sharkloader-targets-global-governments/)
- [CVE-2021-26855 NVD Detail — Microsoft Exchange ProxyLogon SSRF](https://nvd.nist.gov/vuln/detail/CVE-2021-26855)
- [CVE-2024-21762 NVD Detail — Fortinet FortiOS SSL VPN Out-of-Bounds Write](https://nvd.nist.gov/vuln/detail/CVE-2024-21762)
- [CVE-2024-36401 NVD Detail — GeoServer OGC Filter Evaluation RCE](https://nvd.nist.gov/vuln/detail/CVE-2024-36401)
- [CVE-2023-20198 NVD Detail — Cisco IOS XE Web UI Privilege Escalation](https://nvd.nist.gov/vuln/detail/CVE-2023-20198)
- [CVE-2023-46747 NVD Detail — F5 BIG-IP Authentication Bypass](https://nvd.nist.gov/vuln/detail/CVE-2023-46747)
- [CISA KEV — CVE-2021-26855 Microsoft Exchange Server SSRF Known Exploited](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Kaspersky GReAT MalwareTips Forum — Investigate StrikeShark Campaign](https://malwaretips.com/threads/kasperskys-great-investigate-strikeshark-a-new-campaign-delivering-cobalt-strike-through-sharkloader.141948/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0961