Threat reportMalwareTL-2026-1101
SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike
SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and (TL-2026-1101), also tracked as StrikeShark Campaign, is a high-severity malware campaign, first published 2026-07-03. It is attributed to StrikeShark (China) with low confidence, affects Microsoft Exchange Server, references 14 CVEs (CVE-2021-26855, CVE-2021-27076, CVE-2023-32315), maps to 38 MITRE ATT&CK techniques (T1003, T1005, T1007), and is covered by 9 detection rules and 44 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 14Referenced vulnerabilities
- Techniques
- 38MITRE ATT&CK
- Actors
- 1StrikeShark
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 44Indicators of compromise
Key facts for TL-2026-1101
- Threat ID
- TL-2026-1101
- Also known as
- StrikeShark Campaign, SharkLoader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- StrikeShark
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomatic, softwaredevelopment, technology
- Target regions
- Southeast Asia, East Asia, South Asia, Middle East, Balkans, Latin America
- Detection rules
- 9
- Indicators of compromise
- 44
Malware and tooling in SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
Malware and tooling: SharkLoader, StrikeShark, FScan, Microsoft Detours, Pillager, Searchall, SharpGPOAbuse, jitasm
How SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and works
A malware loader dubbed SharkLoader, part of a campaign cluster tracked as StrikeShark, is distributed via trojanized installers spoofing Cisco AnyConnect and Google Update as well as opportunistic exploitation of twelve internet-facing application CVEs. The loader hijacks SystemSettings.exe via DLL side-loading, tampers with ETW, spoofs parent process IDs, and decrypts/executes almost entirely in memory to deploy Cobalt Strike Beacon, which is then used for AD enumeration, LSASS/NTDS credential theft, and lateral movement against government, diplomatic, and software-development targets in nine countries.
SharkLoader is a previously undocumented, multi-stage Windows malware loader used by a threat activity cluster tracked as StrikeShark to deliver Cobalt Strike Beacon against government, diplomatic, and software-development targets across Indonesia (the initial discovery point, a diplomatic organization), Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. StrikeShark uses two parallel initial-access paths: opportunistic exploitation of at least twelve publicly known vulnerabilities in internet-facing software (Microsoft Exchange ProxyLogon CVE-2021-26855, SharePoint CVE-2021-27076, Openfire CVE-2023-32315, GeoServer CVE-2024-36401, Apache Shiro CVE-2016-4437, F5 BIG-IP CVE-2023-46747, Fortinet FortiOS CVE-2024-21762 and CVE-2022-40684, Cisco IOS XE CVE-2023-20198, React Server Components/Next.js CVE-2025-55182 'React2Shell', Microsoft Exchange ProxyNotShell CVE-2022-41082, Zimbra Collaboration Suite CVE-2022-27925, and Hikvision IP camera/NVR firmware CVE-2021-36260), and dropper-based distribution through trojanized installers masquerading as Cisco AnyConnect VPN and Google Update, which display a legitimate decoy installer while silently staging SharkLoader components under %APPDATA%\xwreg, %APPDATA%\xgdf, or %APPDATA%\reports\AnyConnect-win-4.msi. Some droppers additionally embed decoy PDF documents themed around a liquid rocket engine design and a biological wastewater treatment process (staged under %TEMP%\aswerf) to convince targets the installer is benign, while alternate builds drop artifacts named GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls to blend in with legitimate Windows files. Following initial exploitation of some of the public-facing vulnerabilities above, operators have also been observed deploying web shells for persistent access prior to pivoting to SharkLoader/Cobalt Strike deployment.
SharkLoader's core technique is DLL side-loading: it hijacks the legitimate Windows binary SystemSettings.exe (also staged from C:\Windows\ImmersiveControlPanel\, C:\ProgramData\, or C:\ADriveLogs_Logs\) to load a malicious SystemSettings.dll, which decrypts and loads two additional payloads -- DscCoreR.mui (Blowfish-ECB encrypted, containing the Cobalt Strike Beacon and the MinHook library) and SyncRes.dat (AES-128 encrypted, containing over 40 Microsoft Detours API hooks). The loader implements 'Perfect DLL Hijacking,' resolving undocumented ntdll.dll structures (LdrpLoaderLock, LdrpWorkInProgress) to manipulate the Windows loader's internal lock state and permit thread creation from within DllMain despite the active loader lock, bypassing conventional loader-lock safety checks. Alternate side-loading variants observed use msedge.dll, PrintDialog.dll, and miracastview.dll with their corresponding legitimate host applications.
Once loaded, SyncRes.dat's API hooks redirect CreateProcessA/W (capturing parameters for later parent-process-ID spoofing), VirtualAlloc/VirtualProtect and related memory APIs to direct NtAllocateVirtualMemory/NtProtectVirtualMemory syscalls generated via the jitasm JIT assembler library (bypassing userland hooks placed by security products), LoadLibrary/GetProcAddress resolution via ROR13 and Murmur32 API hashing, and stub out EtwEventWrite/EventWrite/EventWriteEx to blind Event Tracing for Windows. SharkLoader further registers a Vectored Exception Handler (VEH) to intercept deliberate access-violation (0xC0000005) faults and redirect execution flow, frustrating debuggers and static disassembly, and schedules payload continuation via APC-based delayed execution (CreateWaitableTimerW/SleepEx) rather than direct Sleep calls to frustrate sandbox and dynamic-analysis timeouts. A VirtualAlloc/Sleep hook pair tracks the first three memory allocations used for Beacon shellcode and toggles their protection from PAGE_EXECUTE_READWRITE to PAGE_READWRITE before each sleep cycle, restoring RWX afterward, defeating memory scanners that hunt for persistently executable regions. Persistence is established via SYSTEM-privileged scheduled tasks ('OneDrive Standalone Update Task-S-1-5-21-4165425321-4153752593-2322023643-1000', 'MicrosoftUpdateTaskUserS-1-5-32-2456537112-101246289-228944324-1000', and '\Microsoft\Windows\Edge\Edgeupdate') and an HKCU Run key value named MFUpdate, all re-launching SystemSettings.exe from attacker-controlled paths.
Post-compromise, operators run standard Windows and PowerShell reconnaissance (systeminfo, ipconfig /all, tasklist /svc, netstat -ano, arp -a, net share, query user), enumerate Active Directory via Get-ADGroupMember, Get-ADUser, and dsquery for domain controllers and privileged groups (Enterprise Admins, Domain Admins, Organization Management), dump LSASS memory with Procdump64.exe, and extract NTDS.dit via ntdsutil IFM. Lateral movement and further collection rely on the open-source tools FScan (network/vulnerability scanner), Searchall and Pillager (sensitive-data collection), and SharpGPOAbuse (Group Policy Object abuse), alongside continued Cobalt Strike Beacon tasking over C2 domains connect-microsoft.com, ms-record.com, ms-record.top, and ms-tray.top; one associated IP conducted internet-wide scanning consistent with opportunistic vulnerability hunting. Kaspersky's Securelist team assesses StrikeShark to be a Chinese-speaking threat actor with low confidence, based on the authorship of the post-exploitation tools (sourced from Chinese-language GitHub repositories) rather than code or infrastructure overlap with known APT clusters.
MITRE ATT&CK techniques used in TL-2026-1101
Credential Access
Collection
Discovery
T1007 System Service Discovery; T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1135 Network Share Discovery
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1134 Access Token Manipulation; T1574 Hijack Execution Flow; T1620 Reflective Code Loading; T1622 Debugger Evasion
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API
Persistence
T1053 Scheduled Task/Job; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1055 Process Injection; T1134 Access Token Manipulation; T1484 Domain or Tenant Policy Modification
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1190 Exploit Public-Facing Application
execution
defense-impairment
T1484 Domain or Tenant Policy Modification; T1685 Disable or Modify Tools
stealth
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
- Microsoft — Exchange Server
Vulnerable versions: Unpatched instances vulnerable to ProxyLogon (CVE-2021-26855); Unpatched instances vulnerable to ProxyNotShell RCE via PowerShell remoting (CVE-2022-41082, chained with CVE-2022-41040)
Fixed in: Patched per Microsoft March 2021 Exchange security updates; Patched per Microsoft October 2022 Patch Tuesday updates - Microsoft — SharePoint Server
Vulnerable versions: Unpatched instances vulnerable to CVE-2021-27076
Fixed in: Patched per Microsoft March 2021 SharePoint security updates - Ignite Realtime — Openfire
Vulnerable versions: 3.10.0 through 4.7.4 (CVE-2023-32315)
Fixed in: 4.7.5, 4.6.8 and later - OSGeo — GeoServer / GeoTools
Vulnerable versions: Prior to 2.22.6, 2.23.6, 2.24.4, 2.25.2 (CVE-2024-36401)
Fixed in: 2.22.6, 2.23.6, 2.24.4, 2.25.2 and later - Apache — Shiro
Vulnerable versions: Before 1.2.5 with unconfigured 'remember me' cipher key (CVE-2016-4437)
Fixed in: 1.2.5+ with explicitly configured cipher key - F5 — BIG-IP
Vulnerable versions: Unpatched instances vulnerable to CVE-2023-46747
Fixed in: Patched per F5 October 2023 security advisory - Fortinet — FortiOS / FortiProxy
Vulnerable versions: FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15 (CVE-2024-21762); versions affected by auth-bypass CVE-2022-40684
Fixed in: 7.6.0, 7.4.3, 7.2.7, 7.0.14, 6.4.15 and later - Cisco — IOS XE
Vulnerable versions: Devices with Web UI feature enabled and exposed to untrusted networks (CVE-2023-20198)
Fixed in: Patched per Cisco October 2023 security advisory - React / Vercel — React Server Components / Next.js
Vulnerable versions: React 19.0, 19.1.0, 19.1.1, 19.2.0; Next.js 15.x/16.x and other RSC frameworks (CVE-2025-55182 'React2Shell')
Fixed in: React 19.0.1, 19.1.2, 19.2.1 and later - Zimbra — Zimbra Collaboration Suite (ZCS)
Vulnerable versions: 8.8.15 and 9.0 prior to patched builds, mboximport arbitrary file upload (CVE-2022-27925)
Fixed in: 8.8.15 Patch 31 / 9.0.0 Patch 24 and later
Remediation for SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
Patches
- Apply Microsoft Exchange March 2021 security updates (ProxyLogon, CVE-2021-26855) and SharePoint updates (CVE-2021-27076).
- Upgrade Openfire to 4.7.5/4.6.8 or later (CVE-2023-32315).
- Upgrade GeoServer to 2.22.6/2.23.6/2.24.4/2.25.2 or later (CVE-2024-36401).
- Upgrade Apache Shiro to 1.2.5+ and configure a non-default 'remember me' cipher key (CVE-2016-4437).
- Apply the F5 BIG-IP October 2023 advisory patch (CVE-2023-46747).
- Upgrade FortiOS/FortiProxy per Fortinet advisory to remediate CVE-2024-21762 and CVE-2022-40684.
- Apply the Cisco IOS XE October 2023 patch for CVE-2023-20198.
- Upgrade React to 19.0.1/19.1.2/19.2.1+ and Next.js to a patched release (CVE-2025-55182).
- Apply Microsoft Exchange October 2022 Patch Tuesday updates remediating ProxyNotShell (CVE-2022-41082/CVE-2022-41040).
- Upgrade Zimbra Collaboration Suite to 8.8.15 Patch 31 / 9.0.0 Patch 24 or later (CVE-2022-27925).
Immediate actions
- Patch/upgrade all internet-facing Exchange, SharePoint, Openfire, GeoServer, Shiro-based apps, F5 BIG-IP, FortiOS/FortiProxy, Cisco IOS XE, React Server Components/Next.js, Zimbra Collaboration Suite, and Hikvision camera/NVR firmware to versions that remediate the twelve exploited CVEs.
- Block the C2 domains connect-microsoft.com, ms-record.com, ms-record.top, and ms-tray.top at DNS/proxy/firewall.
- Hunt for SystemSettings.exe, DscCoreR.mui, and SyncRes.dat co-located outside %WINDIR%\System32, especially under %APPDATA%\xwreg, %APPDATA%\xgdf, C:\Windows\ImmersiveControlPanel\, C:\ADriveLogs_Logs\, or Identities\ subfolders.
- Search Windows Task Scheduler for tasks named 'OneDrive Standalone Update Task-S-1-5-...', 'MicrosoftUpdateTaskUserS-1-5-...', and '\Microsoft\Windows\Edge\Edgeupdate' launching SystemSettings.exe from non-standard paths.
- Review HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for an 'MFUpdate' value pointing to a SystemSettings.exe copy under %APPDATA%\Identities.
- Isolate hosts showing Procdump-style LSASS access or ntdsutil IFM/NTDS.dit extraction outside authorized backup workflows.
- Hunt for any web shells dropped immediately after exploitation of the twelve target CVEs, particularly on internet-facing Exchange, IOS XE, and Openfire hosts.
Workarounds
- Disable internet-facing Web UI/HTTP management interfaces on Cisco IOS XE and Fortinet devices where patching is delayed.
- Disable the Openfire Setup Environment and restrict admin console access to trusted networks.
- Restrict outbound access from server subnets to the identified C2 domains and monitor for beaconing to newly registered look-alike Microsoft-themed domains.
- Restrict or disable Exchange PowerShell remoting access to reduce ProxyNotShell exposure where patching is delayed.
- Place Hikvision and other internet-exposed camera/NVR management interfaces behind a VPN or ACL-restricted management network.
Longer-term hardening
- Deploy EDR with ETW-tamper detection, unbacked-executable-memory scanning, and userland-hook/API-hashing behavioral analytics to counter the loader's Detours-based API hooking, VEH-based anti-analysis, and RWX-to-RW memory-protection evasion.
- Enforce application allow-listing / WDAC to prevent unsigned or relocated copies of SystemSettings.exe, msedge.dll, PrintDialog.dll, and miracastview.dll from loading attacker-supplied side-load DLLs.
- Implement tiered administration and Protected Users / Credential Guard to reduce LSASS memory-dumping and NTDS extraction blast radius.
- Establish a vulnerability management SLA that prioritizes CISA KEV-listed edge-device and groupware CVEs (Exchange, SharePoint, Openfire, GeoServer, Shiro, F5 BIG-IP, FortiOS, Cisco IOS XE, React2Shell, Zimbra, Hikvision) for expedited patching.
- Train users and helpdesk to verify software installers (Cisco AnyConnect, Google Update) only via vendor-signed channels and official update mechanisms, not third-party download sites.
- Segment or replace internet-exposed IoT/surveillance devices (Hikvision cameras/NVRs) that cannot be promptly patched.
CVEs associated with SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
Weaknesses (CWE) in SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
CWE-918, CWE-502, CWE-22, CWE-94, CWE-288, CWE-787, CWE-306, CWE-284, CWE-798, CWE-78
Timeline of SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
- Apache discloses CVE-2016-4437, a default 'remember me' cipher key deserialization RCE in Apache Shiro, later added to StrikeShark's opportunistic exploitation arsenal.
- Microsoft discloses ProxyLogon (CVE-2021-26855) and related Exchange Server vulnerabilities, and CVE-2021-27076 in SharePoint Server, both later exploited by StrikeShark for initial access.
- NVD publishes CVE-2021-36260, an unauthenticated command-injection RCE in Hikvision IP camera/NVR/DVR web servers; CISA issues a companion alert on 2021-09-28. StrikeShark later adds this flaw to its opportunistic exploitation toolkit.
- NVD publishes CVE-2022-27925, an authenticated arbitrary file upload RCE in Zimbra Collaboration Suite's mboximport functionality, subsequently incorporated into StrikeShark's exploitation chain.
- Volexity publishes research documenting mass in-the-wild exploitation of the unauthenticated variant of CVE-2022-27925 against unpatched Zimbra servers.
- GTSC/ZDI disclose CVE-2022-41082 ('ProxyNotShell'), a post-authentication Exchange PowerShell remoting RCE chained with CVE-2022-41040 SSRF; Microsoft issues customer guidance the same week and later adds it to StrikeShark's multi-CVE exploitation arsenal.
- Cisco discloses CVE-2023-20198, an actively exploited IOS XE Web UI privilege-escalation zero-day, subsequently weaponized by StrikeShark against edge devices.
- Fortinet discloses CVE-2024-21762, a critical FortiOS SSL-VPN out-of-bounds write RCE, later incorporated into StrikeShark's exploitation toolkit.
- The React team discloses CVE-2025-55182 ('React2Shell'), a critical pre-auth RCE in React Server Components/Next.js; StrikeShark rapidly adds it to its multi-CVE exploitation chain.
- Kaspersky's Securelist team and PolySwarm publish detailed technical analyses documenting the SharkLoader loader, its DLL side-loading chain, C2 domains, and StrikeShark victimology across nine countries.
- Cyber Security News republishes technical analysis emphasizing trojanized Cisco AnyConnect and Google Update installers as SharkLoader's dropper-based distribution vector, prompting this hunt.
Sources cited for SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and
- Hackers Use Fake Cisco AnyConnect and Google Update Installers
- StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon
- SharkLoader Emerges as Stealthy Cobalt Strike Delivery Framework
- New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
- StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike
- SharkLoader Malware Deploys Cobalt Strike Beacon Through Stealthy In-Memory Execution
- New SharkLoader Malware Targets Diplomatic and Government Entities Across Multiple Countries
- Hackers Use Fake Cisco AnyConnect and Google Update Installers to Drop SharkLoader Malware
- Hackers Use Cisco AnyConnect and Google Update Lures to Drop SharkLoader Malware
- There's A New Malware Hitting Governments Worldwide Now
- Mystery hackers use novel SharkLoader dropper against governments, software devs
- StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
- CVE-2025-55182 Detail - NVD
- CVE-2023-20198 Detail - NVD
- CVE-2024-21762 Detail - NVD
Detection coverage for TL-2026-1101
As of 2026-07-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1101 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.