# SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike

> A malware loader dubbed SharkLoader, part of a campaign cluster tracked as StrikeShark, is distributed via trojanized installers spoofing Cisco AnyConnect and Google Update as well as opportunistic exploitation of twelve internet-facing application CVEs. The loader hijacks SystemSettings.exe via DLL side-loading, tampers with ETW, spoofs parent process IDs, and decrypts/executes almost entirely in memory to deploy Cobalt Strike Beacon, which is then used for AD enumeration, LSASS/NTDS credential theft, and lateral movement against government, diplomatic, and software-development targets in nine countries.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1101
- **ID:** TL-2026-1101
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** StrikeShark (China)
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2021-27076, CVE-2023-32315, CVE-2024-36401, CVE-2016-4437, CVE-2023-46747, CVE-2024-21762, CVE-2022-40684, CVE-2023-20198, CVE-2025-55182, CVE-2022-41082, CVE-2022-27925, CVE-2021-36260, CVE-2022-41040

## Description

SharkLoader is a previously undocumented, multi-stage Windows malware loader used by a threat activity cluster tracked as StrikeShark to deliver Cobalt Strike Beacon against government, diplomatic, and software-development targets across Indonesia (the initial discovery point, a diplomatic organization), Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. StrikeShark uses two parallel initial-access paths: opportunistic exploitation of at least twelve publicly known vulnerabilities in internet-facing software (Microsoft Exchange ProxyLogon CVE-2021-26855, SharePoint CVE-2021-27076, Openfire CVE-2023-32315, GeoServer CVE-2024-36401, Apache Shiro CVE-2016-4437, F5 BIG-IP CVE-2023-46747, Fortinet FortiOS CVE-2024-21762 and CVE-2022-40684, Cisco IOS XE CVE-2023-20198, React Server Components/Next.js CVE-2025-55182 'React2Shell', Microsoft Exchange ProxyNotShell CVE-2022-41082, Zimbra Collaboration Suite CVE-2022-27925, and Hikvision IP camera/NVR firmware CVE-2021-36260), and dropper-based distribution through trojanized installers masquerading as Cisco AnyConnect VPN and Google Update, which display a legitimate decoy installer while silently staging SharkLoader components under %APPDATA%\xwreg, %APPDATA%\xgdf, or %APPDATA%\reports\AnyConnect-win-4.msi. Some droppers additionally embed decoy PDF documents themed around a liquid rocket engine design and a biological wastewater treatment process (staged under %TEMP%\aswerf) to convince targets the installer is benign, while alternate builds drop artifacts named GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls to blend in with legitimate Windows files. Following initial exploitation of some of the public-facing vulnerabilities above, operators have also been observed deploying web shells for persistent access prior to pivoting to SharkLoader/Cobalt Strike deployment.

SharkLoader's core technique is DLL side-loading: it hijacks the legitimate Windows binary SystemSettings.exe (also staged from C:\Windows\ImmersiveControlPanel\, C:\ProgramData\, or C:\ADriveLogs_Logs\) to load a malicious SystemSettings.dll, which decrypts and loads two additional payloads -- DscCoreR.mui (Blowfish-ECB encrypted, containing the Cobalt Strike Beacon and the MinHook library) and SyncRes.dat (AES-128 encrypted, containing over 40 Microsoft Detours API hooks). The loader implements 'Perfect DLL Hijacking,' resolving undocumented ntdll.dll structures (LdrpLoaderLock, LdrpWorkInProgress) to manipulate the Windows loader's internal lock state and permit thread creation from within DllMain despite the active loader lock, bypassing conventional loader-lock safety checks. Alternate side-loading variants observed use msedge.dll, PrintDialog.dll, and miracastview.dll with their corresponding legitimate host applications.

Once loaded, SyncRes.dat's API hooks redirect CreateProcessA/W (capturing parameters for later parent-process-ID spoofing), VirtualAlloc/VirtualProtect and related memory APIs to direct NtAllocateVirtualMemory/NtProtectVirtualMemory syscalls generated via the jitasm JIT assembler library (bypassing userland hooks placed by security products), LoadLibrary/GetProcAddress resolution via ROR13 and Murmur32 API hashing, and stub out EtwEventWrite/EventWrite/EventWriteEx to blind Event Tracing for Windows. SharkLoader further registers a Vectored Exception Handler (VEH) to intercept deliberate access-violation (0xC0000005) faults and redirect execution flow, frustrating debuggers and static disassembly, and schedules payload continuation via APC-based delayed execution (CreateWaitableTimerW/SleepEx) rather than direct Sleep calls to frustrate sandbox and dynamic-analysis timeouts. A VirtualAlloc/Sleep hook pair tracks the first three memory allocations used for Beacon shellcode and toggles their protection from PAGE_EXECUTE_READWRITE to PAGE_READWRITE before each sleep cycle, restoring RWX afterward, defeating memory scanners that hunt for persistently executable regions. Persistence is established via SYSTEM-privileged scheduled tasks ('OneDrive Standalone Update Task-S-1-5-21-4165425321-4153752593-2322023643-1000', 'MicrosoftUpdateTaskUserS-1-5-32-2456537112-101246289-228944324-1000', and '\Microsoft\Windows\Edge\Edgeupdate') and an HKCU Run key value named MFUpdate, all re-launching SystemSettings.exe from attacker-controlled paths.

Post-compromise, operators run standard Windows and PowerShell reconnaissance (systeminfo, ipconfig /all, tasklist /svc, netstat -ano, arp -a, net share, query user), enumerate Active Directory via Get-ADGroupMember, Get-ADUser, and dsquery for domain controllers and privileged groups (Enterprise Admins, Domain Admins, Organization Management), dump LSASS memory with Procdump64.exe, and extract NTDS.dit via ntdsutil IFM. Lateral movement and further collection rely on the open-source tools FScan (network/vulnerability scanner), Searchall and Pillager (sensitive-data collection), and SharpGPOAbuse (Group Policy Object abuse), alongside continued Cobalt Strike Beacon tasking over C2 domains connect-microsoft.com, ms-record.com, ms-record.top, and ms-tray.top; one associated IP conducted internet-wide scanning consistent with opportunistic vulnerability hunting. Kaspersky's Securelist team assesses StrikeShark to be a Chinese-speaking threat actor with low confidence, based on the authorship of the post-exploitation tools (sourced from Chinese-language GitHub repositories) rather than code or infrastructure overlap with known APT clusters.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1106 Native API
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1505 Server Software Component
- T1055 Process Injection
- T1134 Access Token Manipulation
- T1484 Domain or Tenant Policy Modification
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1134 Access Token Manipulation
- T1484 Domain or Tenant Policy Modification
- T1622 Debugger Evasion
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1049 System Network Connections Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1069 Permission Groups Discovery
- T1087 Account Discovery
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1007 System Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System

## Sources

- [Hackers Use Fake Cisco AnyConnect and Google Update Installers](https://cybersecuritynews.com/hackers-use-fake-cisco-anyconnect-and-google-update-installers/)
- [StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon](https://securelist.com/strikeshark-campaign/120326/)
- [SharkLoader Emerges as Stealthy Cobalt Strike Delivery Framework](https://blog.polyswarm.io/sharkloader-emerges-as-stealthy-cobalt-strike-delivery-framework)
- [New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks](https://thehackernews.com/2026/06/new-sharkloader-malware-deploys-cobalt.html)
- [StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike](https://gbhackers.com/sharkloader-malware-to-deploy-cobalt-strike/)
- [SharkLoader Malware Deploys Cobalt Strike Beacon Through Stealthy In-Memory Execution](https://cyberpress.org/sharkloader-in-memory-beacon-attack/)
- [New SharkLoader Malware Targets Diplomatic and Government Entities Across Multiple Countries](https://cyberpress.org/sharkloader-targets-global-governments/)
- [Hackers Use Fake Cisco AnyConnect and Google Update Installers to Drop SharkLoader Malware](https://vpncentral.com/hackers-use-fake-cisco-anyconnect-and-google-update-installers-to-drop-sharkloader-malware/)
- [Hackers Use Cisco AnyConnect and Google Update Lures to Drop SharkLoader Malware](https://www.cryptika.com/hackers-use-cisco-anyconnect-and-google-update-lures-to-drop-sharkloader-malware/)
- [There's A New Malware Hitting Governments Worldwide Now](https://www.techjuice.pk/sharkloader-malware-cobalt-strike-strikeshark-campaign-kaspersky/)
- [Mystery hackers use novel SharkLoader dropper against governments, software devs](https://www.helpnetsecurity.com/2026/06/26/sharkloader-dropper-governments-software-developers/)
- [StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader](https://www.dataproof.co.za/index.php/2026/06/24/strikeshark-investigating-a-new-campaign-delivering-cobalt-strike-through-sharkloader/)
- [CVE-2025-55182 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [CVE-2023-20198 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2023-20198)
- [CVE-2024-21762 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2024-21762)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1101