StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike — Threadlinqs Intelligence
As of 2026-07-11, StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike is a high-severity malware threat attributed to StrikeShark, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-1237 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: StrikeShark · ESPIONAGE
Kaspersky GReAT uncovered StrikeShark, a global espionage campaign using a previously undocumented loader dubbed SharkLoader to deploy Cobalt Strike Beacon. Operators gain initial access via n-day
StrikeShark is a cyber-espionage campaign identified by Kaspersky's Global Research and Analysis Team (GReAT) in June 2026, targeting government organizations, software development companies, and a diplomatic entity across Taiwan, Indonesia, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. The campaign's centerpiece is SharkLoader, a previously undocumented multi-stage malware loader whose sole purpose is to stealthily deploy Cobalt Strike Beacon while evading detection.
Operators achieve initial access via two vectors: (1) exploitation of a broad set of n-day vulnerabilities — some dating back to 2016 — in internet-facing applications including Microsoft Exchange (CVE-2021-26855 ProxyLogon, CVE-2022-41082 ProxyNotShell), Microsoft SharePoint (CVE-2021-27076), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Fortinet FortiOS (CVE-2024-21762, CVE-2022-40684), Cisco IOS XE Web UI (CVE-2023-20198), F5 BIG-IP (CVE-2023-46747), Zimbra Collaboration Suite (CVE-2022-27925), Apache Shiro (CVE-2016-4437), and Hikvision products (CVE-2021-36260); and (2) social engineering via trojanized installers disguised as Cisco AnyConnect VPN and Google Update utilities, plus decoy PDF lures (e.g., a fake liquid rocket engine design document and a biological wastewater treatment process document).
Once executed, the dropper writes a legitimate signed Windows binary (SystemSettings.exe) alongside a malicious SystemSettings.dll for classic DLL side-loading, then employs a technique the researchers term 'Perfect DLL Hijacking' — manipulating undocumented ntdll loader-lock structures (LdrpLoaderLock, LdrpWorkInProgress) via forced LeaveCriticalSection calls and InterlockedDecrement64 state manipulation — to safely spawn a new thread from within DllMain without deadlocking the loader lock. This loads and decrypts an encrypted payload (DscCoreR.mui) using Blowfish in ECB mode with a 16-byte key extracted from the file header, revealing an embedded MinHook library and a zlib-compressed Cobalt Strike Beacon, which is decompressed and injected into a suspended thread's memory. A second encrypted component (SyncRes.dat), protected with AES-128-CBC, installs Microsoft Detours-based API hooks across process creation, memory allocation, module resolution, file I/O, and ETW logging functions to blind security tooling and mask the beacon's memory footprint (toggling PAGE_READWRITE/PAGE_EXECUTE_READWRITE permissions in sync with Beacon's sleep cycles, and using a Vectored Exception Handler to catch and resolve deliberate access violations from hooked syscalls).
Additional identified DLL side-loading carriers include msedge.dll, PrintDialog.dll, and miracastview.dll, and additional decoy/encrypted module filenames observed on disk include GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, and VistaCompat.nls — all designed to blend into legitimate Windows system directories.
Persistence is established via an HKCU Run key (value name MFUpdate pointing at %appdata%\Identities\SystemSettings.exe) and multiple Scheduled Tasks, including a disguised '\Microsoft\Windows\Edge\Edgeupdate' daily SYSTEM task and short-interval bootstrap tasks (a 5-minute 'OneDrive Standalone Update Task' and a transient 1-second 'MicrosoftUpdateTaskUser' task removed after deployment) that relaunch SystemSettings.exe.
Post-compromise, operators deploy Cobalt Strike Beacon for command-and-control, using a small dedicated C2 domain set (connect-microsoft[.]com, ms-record[.]com, ms-record[.]top, ms-tray[.]top) crafted to impersonate Microsoft infrastructure. From the beacon, operators run open-source reconnaissance and post-exploitation tooling — FScan (network/exploitation scanner), Searchall (sensitive file search), Pillager (credential/data harvesting), and SharpGPOAbuse (Group Policy Object abuse for privilege escalation) — alongside native Windows discovery commands (systeminfo, ipconfig /all, tasklist /svc, net group /domain, dsquery, Get-ADG
Weaknesses (CWE)
CWE-287, CWE-22, CWE-502, CWE-434, CWE-269, CWE-798
Target sectors: government administration, softwaredevelopment, diplomatic, technology
Target regions: taiwan, indonesia, hong kong, lebanon, syria, colombia, north macedonia, nepal, serbia, Asia, Europe, Latin America
Timeline
- CVE-2016-4437 (Apache Shiro) disclosed; later observed among the n-day exploits used in the StrikeShark campaign, illustrating the operators' reliance on long-available public exploit code.
- CVE-2021-26855 (Microsoft Exchange ProxyLogon) disclosed and patched by Microsoft.
- CVE-2021-36260 (Hikvision) disclosed.
- CVE-2022-41082 (Microsoft Exchange ProxyNotShell) disclosed.
- CVE-2023-20198 (Cisco IOS XE Web UI) disclosed as actively exploited zero-day, later weaponized as an n-day by StrikeShark operators.
- CVE-2024-21762 (Fortinet FortiOS) disclosed and added to CISA KEV catalog.
- Estimated approximate window in which Kaspersky observed active StrikeShark intrusions using SharkLoader against government and software-development targets (exact first-seen date not disclosed in public reporting).
- Kaspersky publishes press release and Securelist technical deep-dive naming the campaign StrikeShark and the loader SharkLoader.
- The Hacker News, GBHackers, SC Media, and other outlets publish coverage summarizing the Kaspersky findings.
- Help Net Security publishes summary coverage of the SharkLoader dropper campaign, the source article that triggered this threat record.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2021-26855, CVE-2022-41082, CVE-2021-27076, CVE-2023-32315, CVE-2024-36401, CVE-2024-21762, CVE-2022-40684, CVE-2023-20198, CVE-2023-46747, CVE-2022-27925, T1190, T1566, T1059, T1047, T1106, T1547, T1053, T1574, T1055, T1053
