# StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike

> Kaspersky GReAT uncovered StrikeShark, a global espionage campaign using a previously undocumented loader dubbed SharkLoader to deploy Cobalt Strike Beacon. Operators gain initial access via n-day exploitation of internet-facing Exchange, SharePoint, Openfire, FortiOS, Cisco IOS XE, F5 BIG-IP, Zimbra, Apache Shiro, GeoServer, and Hikvision systems, plus trojanized Cisco AnyConnect/Google Update installers and decoy PDFs, followed by DLL side-loading, ETW/API hooking evasion, LSASS/NTDS credential theft, and lateral movement.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1237
- **ID:** TL-2026-1237
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** StrikeShark
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2022-41082, CVE-2021-27076, CVE-2023-32315, CVE-2024-36401, CVE-2024-21762, CVE-2022-40684, CVE-2023-20198, CVE-2023-46747, CVE-2022-27925, CVE-2016-4437, CVE-2021-36260

## Description

StrikeShark is a cyber-espionage campaign identified by Kaspersky's Global Research and Analysis Team (GReAT) in June 2026, targeting government organizations, software development companies, and a diplomatic entity across Taiwan, Indonesia, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. The campaign's centerpiece is SharkLoader, a previously undocumented multi-stage malware loader whose sole purpose is to stealthily deploy Cobalt Strike Beacon while evading detection.

Operators achieve initial access via two vectors: (1) exploitation of a broad set of n-day vulnerabilities — some dating back to 2016 — in internet-facing applications including Microsoft Exchange (CVE-2021-26855 ProxyLogon, CVE-2022-41082 ProxyNotShell), Microsoft SharePoint (CVE-2021-27076), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Fortinet FortiOS (CVE-2024-21762, CVE-2022-40684), Cisco IOS XE Web UI (CVE-2023-20198), F5 BIG-IP (CVE-2023-46747), Zimbra Collaboration Suite (CVE-2022-27925), Apache Shiro (CVE-2016-4437), and Hikvision products (CVE-2021-36260); and (2) social engineering via trojanized installers disguised as Cisco AnyConnect VPN and Google Update utilities, plus decoy PDF lures (e.g., a fake liquid rocket engine design document and a biological wastewater treatment process document).

Once executed, the dropper writes a legitimate signed Windows binary (SystemSettings.exe) alongside a malicious SystemSettings.dll for classic DLL side-loading, then employs a technique the researchers term 'Perfect DLL Hijacking' — manipulating undocumented ntdll loader-lock structures (LdrpLoaderLock, LdrpWorkInProgress) via forced LeaveCriticalSection calls and InterlockedDecrement64 state manipulation — to safely spawn a new thread from within DllMain without deadlocking the loader lock. This loads and decrypts an encrypted payload (DscCoreR.mui) using Blowfish in ECB mode with a 16-byte key extracted from the file header, revealing an embedded MinHook library and a zlib-compressed Cobalt Strike Beacon, which is decompressed and injected into a suspended thread's memory. A second encrypted component (SyncRes.dat), protected with AES-128-CBC, installs Microsoft Detours-based API hooks across process creation, memory allocation, module resolution, file I/O, and ETW logging functions to blind security tooling and mask the beacon's memory footprint (toggling PAGE_READWRITE/PAGE_EXECUTE_READWRITE permissions in sync with Beacon's sleep cycles, and using a Vectored Exception Handler to catch and resolve deliberate access violations from hooked syscalls).

Additional identified DLL side-loading carriers include msedge.dll, PrintDialog.dll, and miracastview.dll, and additional decoy/encrypted module filenames observed on disk include GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls — all designed to blend into legitimate Windows system directories.

Persistence is established via an HKCU Run key (value name MFUpdate pointing at %appdata%\Identities\SystemSettings.exe) and multiple Scheduled Tasks, including a disguised '\Microsoft\Windows\Edge\Edgeupdate' daily SYSTEM task and short-interval bootstrap tasks (a 5-minute 'OneDrive Standalone Update Task' and a transient 1-second 'MicrosoftUpdateTaskUser' task removed after deployment) that relaunch SystemSettings.exe.

Post-compromise, operators deploy Cobalt Strike Beacon for command-and-control, using a small dedicated C2 domain set (connect-microsoft[.]com, ms-record[.]com, ms-record[.]top, ms-tray[.]top) crafted to impersonate Microsoft infrastructure. From the beacon, operators run open-source reconnaissance and post-exploitation tooling — FScan (network/exploitation scanner), Searchall (sensitive file search), Pillager (credential/data harvesting), and SharpGPOAbuse (Group Policy Object abuse for privilege escalation) — alongside native Windows discovery commands (systeminfo, ipconfig /all, tasklist /svc, net group /domain, dsquery, Get-ADGroupMember, query user, arp -a, netstat -ano) and manual enumeration of web-server directories (dir \\c$\inetpub\wwwroot). Credential theft is performed via Procdump64.exe LSASS memory dumps and ntdsutil-driven NTDS.dit extraction for offline Active Directory credential cracking. Windows Event Tracing (ETW) is suppressed at the API level (EtwEventWrite/EventWriteEx/EventWrite hooked to return success without logging) to tamper with security telemetry and evade EDR/SIEM visibility during lateral movement.

Kaspersky assesses, with low confidence, that StrikeShark is operated by a Chinese-speaking threat actor, based on the observed origin of the open-source post-exploitation tooling on GitHub rather than direct code, infrastructure, or linguistic artifact overlap with known APT groups. No confirmed data exfiltration was observed at the time of publication, but the researchers assess the objective as likely political/economic cyber-espionage given the victimology (governments, diplomatic missions, software developers) and the retained capability for follow-on file operations via Cobalt Strike.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1135 Network Share Discovery
- T1033 System Owner/User Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer

## Sources

- [Mystery hackers use novel SharkLoader dropper against governments, software devs](https://www.helpnetsecurity.com/2026/06/26/sharkloader-dropper-governments-software-developers/)
- [StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon](https://securelist.com/strikeshark-campaign/120326/)
- [New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks](https://thehackernews.com/2026/06/new-sharkloader-malware-deploys-cobalt.html)
- [Kaspersky warns of a new StrikeShark campaign targeting organizations in Asia, Latin America and Europe with advanced malware](https://www.kaspersky.com/about/press-releases/kaspersky-warns-of-a-new-strikeshark-campaign-targeting-organizations-in-asia-latin-america-and-europe-with-advanced-malware)
- [Hackers Use Fake Cisco AnyConnect and Google Update Installers to Drop SharkLoader Malware](https://vpncentral.com/hackers-use-fake-cisco-anyconnect-and-google-update-installers-to-drop-sharkloader-malware/)
- [SharkLoader → Cobalt Strike: Why StrikeShark Is a Chain of #7 Events](https://www.tlctc.net/strikeshark.html)
- [StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon](https://gbhackers.com/sharkloader-malware-to-deploy-cobalt-strike/)
- [StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader](https://socradar.io/free-tools/ioc-radar/reports/strikeshark-investigating-a-new-campaign-delivering-cobalt-strike-through-sharkloader-f7414ec2fe73)
- [New SharkLoader malware campaign deploys Cobalt Strike Beacon](https://www.scworld.com/brief/new-sharkloader-malware-campaign-deploys-cobalt-strike-beacon)
- [SharkLoader Emerges as Stealthy Cobalt Strike Delivery Framework](https://blog.polyswarm.io/sharkloader-emerges-as-stealthy-cobalt-strike-delivery-framework)
- [CVE-2024-21762 Detail](https://nvd.nist.gov/vuln/detail/cve-2024-21762)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1237