StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike
StrikeShark Campaign (TL-2026-1237), also tracked as StrikeShark, is a high-severity malware campaign, first published 2026-07-11. It is attributed to StrikeShark with low confidence, affects Microsoft Exchange Server, references 12 CVEs (CVE-2021-26855, CVE-2022-41082, CVE-2021-27076), maps to 27 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-1237
- Threat ID
- TL-2026-1237
- Also known as
- StrikeShark
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution
- StrikeShark
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, softwaredevelopment, diplomatic, technology
- Target regions
- taiwan, indonesia, hong kong, lebanon, syria, colombia, north macedonia, nepal, serbia, Asia, Europe, Latin America
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in StrikeShark Campaign
Malware and tooling: Cobalt Strike Beacon, SharkLoader, Cobalt Strike, FScan, Microsoft Detours, MinHook, Pillager, Searchall, SharpGPOAbuse
Kaspersky GReAT uncovered StrikeShark, a global espionage campaign using a previously undocumented loader dubbed SharkLoader to deploy Cobalt Strike Beacon. Operators gain initial access via n-day exploitation of internet-facing Exchange, SharePoint, Openfire, FortiOS, Cisco IOS XE, F5 BIG-IP, Zimbra, Apache Shiro, GeoServer, and Hikvision systems, plus trojanized Cisco AnyConnect/Google Update installers and decoy PDFs, followed by DLL side-loading, ETW/API hooking evasion, LSASS/NTDS credential theft, and lateral movement.
How StrikeShark Campaign works
StrikeShark is a cyber-espionage campaign identified by Kaspersky's Global Research and Analysis Team (GReAT) in June 2026, targeting government organizations, software development companies, and a diplomatic entity across Taiwan, Indonesia, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. The campaign's centerpiece is SharkLoader, a previously undocumented multi-stage malware loader whose sole purpose is to stealthily deploy Cobalt Strike Beacon while evading detection.
Operators achieve initial access via two vectors: (1) exploitation of a broad set of n-day vulnerabilities — some dating back to 2016 — in internet-facing applications including Microsoft Exchange (CVE-2021-26855 ProxyLogon, CVE-2022-41082 ProxyNotShell), Microsoft SharePoint (CVE-2021-27076), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Fortinet FortiOS (CVE-2024-21762, CVE-2022-40684), Cisco IOS XE Web UI (CVE-2023-20198), F5 BIG-IP (CVE-2023-46747), Zimbra Collaboration Suite (CVE-2022-27925), Apache Shiro (CVE-2016-4437), and Hikvision products (CVE-2021-36260); and (2) social engineering via trojanized installers disguised as Cisco AnyConnect VPN and Google Update utilities, plus decoy PDF lures (e.g., a fake liquid rocket engine design document and a biological wastewater treatment process document).
Once executed, the dropper writes a legitimate signed Windows binary (SystemSettings.exe) alongside a malicious SystemSettings.dll for classic DLL side-loading, then employs a technique the researchers term 'Perfect DLL Hijacking' — manipulating undocumented ntdll loader-lock structures (LdrpLoaderLock, LdrpWorkInProgress) via forced LeaveCriticalSection calls and InterlockedDecrement64 state manipulation — to safely spawn a new thread from within DllMain without deadlocking the loader lock. This loads and decrypts an encrypted payload (DscCoreR.mui) using Blowfish in ECB mode with a 16-byte key extracted from the file header, revealing an embedded MinHook library and a zlib-compressed Cobalt Strike Beacon, which is decompressed and injected into a suspended thread's memory. A second encrypted component (SyncRes.dat), protected with AES-128-CBC, installs Microsoft Detours-based API hooks across process creation, memory allocation, module resolution, file I/O, and ETW logging functions to blind security tooling and mask the beacon's memory footprint (toggling PAGE_READWRITE/PAGE_EXECUTE_READWRITE permissions in sync with Beacon's sleep cycles, and using a Vectored Exception Handler to catch and resolve deliberate access violations from hooked syscalls).
Additional identified DLL side-loading carriers include msedge.dll, PrintDialog.dll, and miracastview.dll, and additional decoy/encrypted module filenames observed on disk include GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls — all designed to blend into legitimate Windows system directories.
Persistence is established via an HKCU Run key (value name MFUpdate pointing at %appdata%\Identities\SystemSettings.exe) and multiple Scheduled Tasks, including a disguised '\Microsoft\Windows\Edge\Edgeupdate' daily SYSTEM task and short-interval bootstrap tasks (a 5-minute 'OneDrive Standalone Update Task' and a transient 1-second 'MicrosoftUpdateTaskUser' task removed after deployment) that relaunch SystemSettings.exe.
Post-compromise, operators deploy Cobalt Strike Beacon for command-and-control, using a small dedicated C2 domain set (connect-microsoft[.]com, ms-record[.]com, ms-record[.]top, ms-tray[.]top) crafted to impersonate Microsoft infrastructure. From the beacon, operators run open-source reconnaissance and post-exploitation tooling — FScan (network/exploitation scanner), Searchall (sensitive file search), Pillager (credential/data harvesting), and SharpGPOAbuse (Group Policy Object abuse for privilege escalation) — alongside native Windows discovery commands (systeminfo, ipconfig /all, tasklist /svc, net group /domain, dsquery, Get-ADGroupMember, query user, arp -a, netstat -ano) and manual enumeration of web-server directories (dir \\c$\inetpub\wwwroot). Credential theft is performed via Procdump64.exe LSASS memory dumps and ntdsutil-driven NTDS.dit extraction for offline Active Directory credential cracking. Windows Event Tracing (ETW) is suppressed at the API level (EtwEventWrite/EventWriteEx/EventWrite hooked to return success without logging) to tamper with security telemetry and evade EDR/SIEM visibility during lateral movement.
Kaspersky assesses, with low confidence, that StrikeShark is operated by a Chinese-speaking threat actor, based on the observed origin of the open-source post-exploitation tooling on GitHub rather than direct code, infrastructure, or linguistic artifact overlap with known APT groups. No confirmed data exfiltration was observed at the time of publication, but the researchers assess the objective as likely political/economic cyber-espionage given the victimology (governments, diplomatic missions, software developers) and the retained capability for follow-on file operations via Cobalt Strike.
MITRE ATT&CK techniques used in TL-2026-1237
Credential Access
Collection
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1135 Network Share Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1053 Scheduled Task/Job; T1055 Process Injection
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing
stealth
defense-impairment
Affected products and versions in StrikeShark Campaign
- Microsoft — Exchange Server
Vulnerable versions: Exchange 2013; Exchange 2016; Exchange 2019
Fixed in: patched per CVE-2021-26855/CVE-2022-41082 cumulative updates - Microsoft — SharePoint Server
Vulnerable versions: versions affected by CVE-2021-27076
Fixed in: patched builds per Microsoft advisory - Ignite Realtime — Openfire
Vulnerable versions: versions prior to fix for CVE-2023-32315
Fixed in: Openfire 4.6.8, 4.7.5, 4.8.0+ - OSGeo — GeoServer
Vulnerable versions: versions affected by CVE-2024-36401
Fixed in: GeoServer patched releases - Fortinet — FortiOS
Vulnerable versions: versions affected by CVE-2024-21762 and CVE-2022-40684
Fixed in: FortiOS patched builds per Fortinet PSIRT advisories - Cisco — IOS XE
Vulnerable versions: versions affected by CVE-2023-20198
Fixed in: Cisco IOS XE patched releases - F5 — BIG-IP
Vulnerable versions: versions affected by CVE-2023-46747
Fixed in: F5 patched builds - Zimbra — Collaboration Suite
Vulnerable versions: versions affected by CVE-2022-27925
Fixed in: Zimbra patched builds - Apache — Shiro
Vulnerable versions: versions prior to 1.3.2
Fixed in: Apache Shiro 1.3.2+ - Hikvision — IP Cameras / NVRs
Vulnerable versions: versions affected by CVE-2021-36260
Fixed in: Hikvision patched firmware
Remediation for StrikeShark Campaign
Patches
- Microsoft Exchange: apply CVE-2021-26855 and CVE-2022-41082 cumulative updates
- Microsoft SharePoint: apply CVE-2021-27076 security update
- Openfire: upgrade past versions vulnerable to CVE-2023-32315
- GeoServer: upgrade past versions vulnerable to CVE-2024-36401
- Fortinet FortiOS: apply patches for CVE-2024-21762 and CVE-2022-40684
- Cisco IOS XE: apply fix for CVE-2023-20198 and disable internet-exposed Web UI
- F5 BIG-IP: apply patch for CVE-2023-46747
- Zimbra Collaboration Suite: apply patch for CVE-2022-27925
- Apache Shiro: upgrade past version vulnerable to CVE-2016-4437
- Hikvision products: apply firmware fix for CVE-2021-36260
Immediate actions
- Patch or virtually patch all internet-facing Exchange, SharePoint, Openfire, GeoServer, FortiOS, Cisco IOS XE, F5 BIG-IP, Zimbra, Apache Shiro, and Hikvision deployments against the listed CVEs
- Block the identified C2 domains (connect-microsoft[.]com, ms-record[.]com, ms-record[.]top, ms-tray[.]top) at DNS/perimeter
- Hunt for the SHA/MD5 hashes and filenames listed in IOCs across endpoint telemetry and EDR
- Verify integrity of SystemSettings.exe/dll and disallow unsigned writes into Windows system directories
- Audit HKCU Run keys for the 'MFUpdate' value and Scheduled Tasks named 'Edgeupdate', 'OneDrive Standalone Update Task', or 'MicrosoftUpdateTaskUser'
Workarounds
- Disable or restrict access to Cisco IOS XE Web UI from the internet
- Restrict Openfire/GeoServer/Zimbra admin interfaces to trusted networks only pending patching
- Block execution of Procdump64.exe and ntdsutil.exe outside authorized IT admin contexts via application control
Longer-term hardening
- Deploy EDR with kernel-level ETW tamper detection (protected event channels) rather than relying solely on user-mode ETW providers
- Restrict and monitor use of Cisco AnyConnect and Google Update installer distribution channels; enforce code-signing + hash allowlisting for VPN/update installers
- Implement credential-guard / LSA protection to blunt Procdump-based LSASS dumping
- Deploy network segmentation limiting internet-facing app servers from reaching domain controllers and NTDS.dit
CVEs associated with StrikeShark Campaign
CVE-2021-26855, CVE-2022-41082, CVE-2021-27076, CVE-2023-32315, CVE-2024-36401, CVE-2024-21762, CVE-2022-40684, CVE-2023-20198, CVE-2023-46747, CVE-2022-27925, CVE-2016-4437, CVE-2021-36260
Weaknesses (CWE) in StrikeShark Campaign
CWE-287, CWE-22, CWE-502, CWE-434, CWE-269, CWE-798
Timeline of StrikeShark Campaign
- CVE-2016-4437 (Apache Shiro) disclosed; later observed among the n-day exploits used in the StrikeShark campaign, illustrating the operators' reliance on long-available public exploit code.
- CVE-2021-26855 (Microsoft Exchange ProxyLogon) disclosed and patched by Microsoft.
- CVE-2021-36260 (Hikvision) disclosed.
- CVE-2022-41082 (Microsoft Exchange ProxyNotShell) disclosed.
- CVE-2023-20198 (Cisco IOS XE Web UI) disclosed as actively exploited zero-day, later weaponized as an n-day by StrikeShark operators.
- CVE-2024-21762 (Fortinet FortiOS) disclosed and added to CISA KEV catalog.
- Estimated approximate window in which Kaspersky observed active StrikeShark intrusions using SharkLoader against government and software-development targets (exact first-seen date not disclosed in public reporting).
- Kaspersky publishes press release and Securelist technical deep-dive naming the campaign StrikeShark and the loader SharkLoader.
- The Hacker News, GBHackers, SC Media, and other outlets publish coverage summarizing the Kaspersky findings.
- Help Net Security publishes summary coverage of the SharkLoader dropper campaign, the source article that triggered this threat record.
Sources cited for StrikeShark Campaign
- Mystery hackers use novel SharkLoader dropper against governments, software devs
- StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon
- New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
- Kaspersky warns of a new StrikeShark campaign targeting organizations in Asia, Latin America and Europe with advanced malware
- Hackers Use Fake Cisco AnyConnect and Google Update Installers to Drop SharkLoader Malware
- SharkLoader → Cobalt Strike: Why StrikeShark Is a Chain of #7 Events
- StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon
- StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
- New SharkLoader malware campaign deploys Cobalt Strike Beacon
- SharkLoader Emerges as Stealthy Cobalt Strike Delivery Framework
- CVE-2024-21762 Detail
- CISA Known Exploited Vulnerabilities Catalog
Threats related to StrikeShark Campaign
- SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike
- SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign
- APT41/Silver Dragon Expanding Enterprise Attack Surface — Google Drive C2, AppDomain Hijacking, Cloud/Supply Chain Targeting
- Khunt Post-Exploitation Toolkit Deployed via Oracle Database JVM (Huntress Discovery)
- Aquatic Panda (Earth Lusca) APT - Log4Shell Exploitation and Multi-Platform Backdoor Campaigns Targeting 17 Countries
- UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud
Detection coverage for TL-2026-1237
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1237 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.