StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike — Threadlinqs Intelligence
As of 2026-07-11, StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike is a high-severity malware threat attributed to StrikeShark, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-1237 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: StrikeShark · ESPIONAGE
Kaspersky GReAT uncovered StrikeShark, a global espionage campaign using a previously undocumented loader dubbed SharkLoader to deploy Cobalt Strike Beacon. Operators gain initial access via n-day
StrikeShark is a cyber-espionage campaign identified by Kaspersky's Global Research and Analysis Team (GReAT) in June 2026, targeting government organizations, software development companies, and a diplomatic entity across Taiwan, Indonesia, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. The campaign's centerpiece is SharkLoader, a previously undocumented multi-stage malware loader whose sole purpose is to stealthily deploy Cobalt Strike Beacon while evading detection.
Operators achieve initial access via two vectors: (1) exploitation of a broad set of n-day vulnerabilities — some dating back to 2016 — in internet-facing applications including Microsoft Exchange (CVE-2021-26855 ProxyLogon, CVE-2022-41082 ProxyNotShell), Microsoft SharePoint (CVE-2021-27076), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Fortinet FortiOS (CVE-2024-21762, CVE-2022-40684), Cisco IOS XE Web UI (CVE-2023-20198), F5 BIG-IP (CVE-2023-46747), Zimbra Collaboration Suite (CVE-2022-27925), Apache Shiro (CVE-2016-4437), and Hikvision products (CVE-2021-36260); and (2) social engineering via trojanized installers disguised as Cisco AnyConnect VPN and Google Update utilities, plus decoy PDF lures (e.g., a fake liquid rocket engine design document and a biological wastewater treatment process document).
Once executed, the dropper writes a legitimate signed Windows binary (SystemSettings.exe) alongside a malicious SystemSettings.dll for classic DLL side-loading, then employs a technique the researchers term 'Perfect DLL Hijacking' — manipulating undocumented ntdll loader-lock structures (LdrpLoaderLock, LdrpWorkInProgress) via forced LeaveCriticalSection calls and InterlockedDecrement64 state manipulation — to safely spawn a new thread from within DllMain without deadlocking the loader lock. This loads and decrypts an encrypted payload (DscCoreR.mui) using Blowfish in ECB mode with a 16-byte key extracted from the file header, revealing an embedded MinHook library and a zlib-compressed Cobalt Strike Beacon, which is decompressed and injected into a suspended thread's memory. A second encrypted component (SyncRes.dat), protected with AES-128-CBC, installs Microsoft Detours-based API hooks across process creation, memory allocation, module resolution, file I/O, and ETW logging functions to blind security tooling and mask the beacon's memory footprint (toggling PAGE_READWRITE/PAGE_EXECUTE_READWRITE permissions in sync with Beacon's sleep cycles, and using a Vectored Exception Handler to catch and resolve deliberate access violations from hooked syscalls).
Additional identified DLL side-loading carriers include msedge.dll, PrintDialog.dll, and miracastview.dll, and additional decoy/encrypted module filenames observed on disk include GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls — all designed to blend into legitimate Windows system directories.
Persistence is established via an HKCU Run key (value name MFUpdate pointing at %appdata%\Identities\SystemSettings.exe) and multiple Scheduled Tasks, including a disguised '\Microsoft\Windows\Edge\Edgeupdate' daily SYSTEM task and short-interval bootstrap tasks (a 5-minute 'OneDrive Standalone Update Task' and a transient 1-second 'MicrosoftUpdateTaskUser' task removed after deployment) that relaunch SystemSettings.exe.
Post-compromise, operators deploy Cobalt Strike Beacon for command-and-control, using a small dedicated C2 domain set (connect-microsoft[.]com, ms-record[.]com, ms-record[.]top, ms-tray[.]top) crafted to impersonate Microsoft infrastructure. From the beacon, operators run open-source reconnaissance and post-exploitation tooling — FScan (network/exploitation scanner), Searchall (sensitive file search), Pillager (credential/data harvesting), and SharpGPOAbuse (Group Policy Object abuse for privilege escalation) — alongside native Windows discovery commands (systeminfo, ipconfig /all, tasklist /svc, net group /domain, dsquery, Get-ADG
Weaknesses (CWE)
CWE-287, CWE-22, CWE-502, CWE-434, CWE-269, CWE-798
Target sectors: government administration, softwaredevelopment, diplomatic, technology
Target regions: taiwan, indonesia, hong kong, lebanon, syria, colombia, north macedonia, nepal, serbia, Asia, Europe, Latin America
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2021-26855, CVE-2022-41082, CVE-2021-27076, CVE-2023-32315, CVE-2024-36401, CVE-2024-21762, CVE-2022-40684, CVE-2023-20198, CVE-2023-46747, CVE-2022-27925, T1190, T1566, T1059, T1047, T1106, T1547, T1053, T1574, T1574, T1055