StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

1. Executive summary

Kaspersky researchers identified a previously undocumented malware family, "SharkLoader," deployed by a threat cluster tracked as "StrikeShark" to deliver Cobalt Strike Beacon. The campaign leverages publicly available proof-of-concept exploits against internet-facing applications — including Microsoft Exchange (CVE-2021-26855, CVSS 9.1 CRITICAL, in CISA KEV), Openfire (CVE-2023-32315, CVSS 8.6 HIGH, in CISA KEV), and GeoServer (CVE-2024-36401, CVSS 9.8 CRITICAL, in CISA KEV) — alongside custom droppers masquerading as legitimate software. Attribution to a Chinese-speaking threat actor is assessed with low confidence and remains preliminary; the actor "StrikeShark" has no MITRE ATT&CK profile, and attribution should be treated as unconfirmed. EMEA financial services organisations running exposed Exchange, SharePoint, Openfire, or GeoServer instances face immediate risk of webshell deployment, credential dumping, and lateral movement via Cobalt Strike.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access via exploitation of internet-facing applications. The threat actor exploits publicly known vulnerabilities with available PoC code. Confirmed exploitation vectors: - Microsoft Exchange — CVE-2021-26855 (ProxyLogon), CVSS 9.1 CRITICAL, CISA KEV (added 2021-11-03), EPSS 100%, CWE-918. Observed against an Indonesian diplomatic entity. - Openfire Server — CVE-2023-32315, CVSS 8.6 HIGH, CISA KEV (added 2023-08-24), EPSS 100%, CWE-22. Observed against software development organisations in Taiwan. - GeoServer — CVE-2024-36401, CVSS 9.8 CRITICAL, CISA KEV (added 2024-07-15), EPSS 100%, CWE-95, CWE-94. Observed against a Colombian organisation. - Microsoft SharePoint — CVE-2021-27076, CVSS 8.8 HIGH, NOT in CISA KEV, EPSS 9%. Observed in a separate incident launching the SharkLoader sideloading chain from different directories. - Additional vulnerabilities observed across the campaign: Apache Shiro (CVE-2016-4437), Hikvision (CVE-2021-36260), Zimbra Collaboration Suite (CVE-2022-27925), Microsoft Exchange Server (CVE-2022-41082), F5 BIG-IP (CVE-2023-46747), Fortinet FortiOS (CVE-2024-21762), React Server Components (CVE-2025-55182), Fortinet FortiOS auth bypass (CVE-2022-40684), Cisco IOS XE Web UI (CVE-2023-20198).
2. Persistence via webshell. Following exploitation, the attacker deploys webshells on compromised servers. Webshell files were not recovered, but command execution telemetry and webshell detection records confirm their use for post-exploitation.
3. DLL sideloading chain initiated. The attacker copies the legitimate SystemSettings.exe from C:\Windows\ImmersiveControlPanel\ to a new location (e.g., C:\ProgramData\, %APPDATA%\xwreg, %APPDATA%\xgdf, or directories named after security vendors such as C:\ProgramData\KasperskyLab\ or %APPDATA%\kasperskylab). The malicious SystemSettings.dll (SharkLoader) and encrypted payload files are uploaded to the same directory. Execution of SystemSettings.exe triggers DLL sideloading.
4. SharkLoader execution via "Perfect DLL Hijacking." SystemSettings.dll manipulates the Windows loader lock to safely create a malicious thread from DllMain: - Resolves LdrpLoaderLock and LdrpWorkInProgress in ntdll.dll. - Calls LeaveCriticalSection on LdrpLoaderLock to release the loader lock. - Decuments LdrpWorkInProgress via InterlockedDecrement64. - Signals loader completion via SetEvent. - Creates a new thread via CreateThread to execute malicious functionality without deadlock.
5. Decryption and reflective loading of DscCoreR.mui. The first thread spawns a second thread that: - Reads the encrypted DscCoreR.mui file. - Extracts the first 16 bytes as a Blowfish decryption key. - Initialises Blowfish with custom P-array and S-box constants. - Decrypts in ECB mode. - Reflectively loads the resulting PE (MZ header removed as anti-analysis measure) into memory: parses headers, allocates memory, maps sections, applies relocations, resolves imports, sets memory protections. - Transfers execution to the packer stub entry point, which unpacks the protected code, invokes DllMain, and returns to SystemSettings.dll. - SystemSettings.dll calls the exported function SetUserProcessPriorityBoost from the mapped DLL, triggering the fully unpacked next-stage DLL.
6. DscCoreR.mui loads and decrypts SyncRes.dat. The decrypted DscCoreR.mui module: - Reads SyncRes.dat. - Extracts a 16-byte AES-128 key (first 16 bytes) and a 16-byte IV (bytes 17–32). - Decrypts the remaining file content using AES-128 with the extracted key and IV. - Reflectively loads the resulting PE (MZ header removed), protected by an unknown custom packer. - Transfers execution to the packer stub, which unpacks and calls the exported function StartEngineData.
7. API hook installation via SyncRes.dat (Microsoft Detours). The decrypted SyncRes.dat DLL installs hooks on the following Windows APIs using the Microsoft Detours library, committed via DetourTransactionCommitEx: - CreateProcessA, CreateProcessW — new processes spawned under svchost.exe instead of the current process. - OpenProcessToken, AdjustTokenPrivileges, OpenProcess, WriteProcessMemory, NtCreateUserProcess. - LoadLibraryA, LoadLibraryExA, GetModuleHandleA, GetModuleHandleW, GetProcAddress. - VirtualAllocEx, VirtualProtectEx, VirtualProtect. - ResumeThread, GetThreadContext, OpenThread, NtCreateThread, NtCreateThreadEx, NtQueueApcThread, NtQueueApcThreadEx. - ExpandEnvironmentStringsA, CreateFileMappingA, MapViewOfFile, UnmapViewOfFile, NtMapViewOfSectionEx, NtCreateNamedPipeFile, NtReadFile, NtWriteFile. - EtwEventWrite, EventWriteEx, EventWrite.
8. VEH registration. DscCoreR.mui registers a Vectored Exception Handler monitoring access violation exceptions (0xC0000005). On exception, it calls VirtualProtect to restore RWX permissions to the faulting memory page before resuming execution.
9. MinHook deployment and Sleep/VirtualAlloc hooking. DscCoreR.mui decompresses a zlib-compressed MinHook PE file and uses MH_Initialize and MH_CreateHook to install hooks on: - VirtualAlloc — captures addresses and sizes of the first three successful memory allocations (tracking beacon shellcode memory regions). - Sleep — when Cobalt Strike Beacon calls Sleep, the hook temporarily changes memory protection of tracked regions to PAGE_READWRITE (RW) via VirtualProtect before calling the original Sleep, then restores to PAGE_EXECUTE_READWRITE (RWX). This evades memory scanning for executable RWX regions.
10. Cobalt Strike Beacon execution. DscCoreR.mui decompresses zlib-compressed Cobalt Strike Beacon shellcode, allocates executable memory via VirtualAlloc (RWX), copies the beacon into the buffer, and resumes a previously suspended thread to execute the beacon.

Dropper-based delivery (alternative initial access vector)

In parallel to exploitation, the threat actor distributes SharkLoader through custom dropper executables masquerading as legitimate software. Observed dropper filenames:

• GoogleUpdateStepup.exe
• AnyConnect-win-4.10.04071-predeploy-k9exe
• AutoUpdate.exe
• 319-pfd-8001-reva_traitement biologique_master.zip
• 一种异常状况的截图（包括操作系统和输入法版本）.pdf.exe (MD5: 24FCEBDEECBA65004FDB0923763D74FD)

Cisco AnyConnect lure mechanism: A custom dropper extracts zlib-compressed data from its resource section, decompresses it into an MSI package, and writes to %APPDATA%\reports\AnyConnect-win-4.msi. The legitimate Cisco AnyConnect VPN installer is executed via ShellExecuteW API. While the installer runs, SharkLoader components are silently dropped into other %APPDATA% subdirectories and executed after installation completes.

Decoy PDF mechanism: Several droppers embed PDF documents in their resource section under the resource name TELEMETRY, compressed with zlib. Upon execution, the dropper extracts and decompresses the PDF, writes it to %TEMP%\aswerf\ (or directly to %TEMP%) using the same filename as the dropper with a .PDF extension, and launches it via cmd.exe /c.

Dropper deployment of SharkLoader components (Lebanon sample, MD5: 1F65544978B8EA0E745E573B8EE9684B)

• Extracts and decompresses SystemSettings.dll from zlib-compressed data, writes to %APPDATA%\xwreg.
• Extracts and decompresses DscCoreR.mui from resource named VAULTSVCD, writes to %APPDATA%\xwreg.
• Extracts and decompresses SyncRest.dat from resource named UMRDPRDAT, writes to %APPDATA%\xwreg.
• Copies legitimate SystemSettings.exe from C:\Windows\ImmersiveControlPanel to the target location to facilitate DLL sideloading.

Scheduled task persistence (dropper-based): The dropper creates two scheduled tasks via Windows Task Scheduler COM interfaces:

• Task 1: Time-based trigger, executes every 5 minutes — long-term persistence.
• Task 2: Executes every 1 second — ensures immediate execution.
• Both tasks execute the copied SystemSettings.exe from the malware's working directory (e.g., %APPDATA%\xwreg or %APPDATA%\xgdf).
• After ~1.5 seconds, the dropper removes Task 2 via Task Scheduler COM interfaces, leaving Task 1 in place.

Persistence mechanisms (post-exploitation, exploitation-based intrusions)

Registry Run key (Hong Kong incident)

reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "MFUpdate" /t REG_SZ /d "$appdata\Identities\SystemSettings.exe" /f

Scheduled task (Indonesia diplomatic entity incident)

Schtasks /create /s /u "" /p "" /ru "SYSTEM" /tn "\Microsoft\Windows\Edge\Edgeupdate" /sc DAILY /tr "C:\ADriveLogs_Logs\SystemSettings.exe /F"

Runs with SYSTEM privileges, ensuring execution even with no user logged in.

Post-exploitation activity

System reconnaissance

systeminfo
ipconfig /all
tasklist /svc

Active Directory enumeration (Indonesia diplomatic entity)

ping -n
netstat -ano
arp -a
net share
query user
nslookup
quser
net group /domain
powershell "Get-ADGroupMember -Identity "" -Recursive | Select-Object Name, ObjectClass"
dsquery group -name "" | dsget group -members -expand | dsget user -samid -display -email"
powershell "Get-ADGroupMember -Identity "" -Recursive | Where-Object { $_.ObjectClass -eq "computer" } | Select-Object Name, SamAccountName"
powershell -exec bypass -c "Get-ADUser -Filter * -Prop * | select sAMAccountName
net group "Domain Controllers" /domain
net group "Enterprise Admins" /domain
net group "Organization Management" /domain
net group "domain admins" /domain
tasklist /SVC | findstr $selfname.exe
dir \\c$
dir \\c$\inetpub
dir \\c$\inetpub\custerr
dir \\c$\inetpub\wwwroot\

Credential dumping

ntdsutil "ac i ntds" "ifm" "create full $temp" q q
Procdump64.exe -accepteula -ma lsass.exe $temp\lsass.dmp

LSASS process dump extracts in-memory credentials; NTDS database access retrieves Active Directory account password hashes.

Post-exploitation tools used (open-source, Chinese-speaking developer-associated)

• FScan — network scanner with vulnerability exploitation modules.
• Searchall — sensitive information search tool.
• Pillager — information gathering tool.
• SharpGPOAbuse — modifies Group Policy Objects within Active Directory environments.

SharkLoader component summary

Alternative DLL sideloading targets

Other SharkLoader variants leverage: msedge.dll, PrintDialog.dll, miracastview.dll, each with a corresponding legitimate application.

Alternative encrypted module filenames

GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, VistaCompat.nls.

Confidence caveats

• Attribution is unconfirmed. The actor "StrikeShark" has no MITRE ATT&CK profile in the verified reference data. Kaspersky assesses a Chinese-speaking threat actor with low confidence based on the use of open-source tools developed by Chinese-speaking developers. No code reuse, infrastructure overlap, or operational similarity to known APT or cybercrime groups has been identified. This attribution is single-sourced (Kaspersky only); verify before enforcement.
• Expit availability. Kaspersky states they have not obtained the exploits used by the attackers. The assessment that the actor relies on publicly available PoC exploits is medium confidence.
• Campaign scope. Kaspersky notes their visibility is limited to Kaspersky telemetry; the actual number of compromises may be significantly higher. This is single-sourced; verify before enforcement.
• No confirmed data exfiltration. No evidence of data exfiltration has been observed. Cobalt Strike's file operation and data exfiltration modules could be employed at a later stage, but this is speculative.

4. Mitigation & containment

P1 — Within 24 hours

1. Patch all internet-facing applications for CISA KEV-listed CVEs exploited in this campaign: - Microsoft Exchange: CVE-2021-26855 (ProxyLogon) — CVSS 9.1 CRITICAL. - Openfire Server: CVE-2023-32315 — CVSS 8.6 HIGH. - GeoServer: CVE-2024-36401 — CVSS 9.8 CRITICAL. - Microsoft SharePoint: CVE-2021-27076 — CVSS 8.8 HIGH (not in CISA KEV but exploited in this campaign).
2. Patch additional CVEs observed across the campaign: - Apache Shiro: CVE-2016-4437 - Hikvision: CVE-2021-36260 - Zimbra Collaboration Suite: CVE-2022-27925 - Microsoft Exchange Server: CVE-2022-41082 - F5 BIG-IP: CVE-2023-46747 - Fortinet FortiOS: CVE-2024-21762, CVE-2022-40684 - Cisco IOS XE Web UI: CVE-2023-20198 - React Server Components: CVE-2025-55182
3. Block known C2 domains at egress proxy/DNS sinkhole/firewall: - connect-microsoft[.]com - ms-record[.]com - ms-record[.]top - ms-tray[.]top
4. Quarantine any system with files matching the observed MD5 hashes (see §5).
5. Hunt for scheduled tasks matching observed names: - \Microsoft\Windows\Edge\Edgeupdate - Any task executing SystemSettings.exe from non-standard paths (C:\ProgramData\, %APPDATA%\xwreg, %APPDATA%\xgdf, C:\ADriveLogs_Logs\, %APPDATA%\Identities\).
6. Hunt for registry Run key: - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run → value MFUpdate pointing to SystemSettings.exe.

P2 — Within 72 hours

1. EDR/SIEM detection rules for DLL sideloading: Alert on SystemSettings.exe executing from any path other than C:\Windows\ImmersiveControlPanel\. Specifically alert on SystemSettings.exe loading SystemSettings.dll from %APPDATA%\xwreg, %APPDATA%\xgdf, C:\ProgramData\, C:\ProgramData\KasperskyLab\, %APPDATA%\kasperskylab\, C:\ADriveLogs_Logs\, or %APPDATA%\Identities\.
2. EDR detection for alternative sideloading targets: Alert on msedge.dll, PrintDialog.dll, or miracastview.dll loaded from non-standard paths.
3. Monitor for dropper filenames: GoogleUpdateStepup.exe, AnyConnect-win-4.10.04071-predeploy-k9exe, AutoUpdate.exe, 319-pfd-8001-reva_traitement biologique_master.zip, 一种异常状况的截图（包括操作系统和输入法版本）.pdf.exe.
4. Hunt for SharkLoader component filenames in non-standard paths: DscCoreR.mui, SyncRes.dat, SyncRest.dat, GameInputInboxs32.mui, diagerr.xml, NtfsLog.etl, Ignored.Dat, VistaCompat.nls.
5. Monitor for credential dumping tools: Alert on Procdump64.exe targeting lsass.exe and ntdsutil with "ac i ntds" "ifm" "create full" arguments.
6. Hunt for post-exploitation tool execution: FScan, Searchall, Pillager, SharpGPOAbuse.

P3 — Within 7 days

1. Conduct a full audit of internet-facing application exposure: Ensure no Exchange, SharePoint, Openfire, GeoServer, Apache Shiro, Hikvision, Zimbra, F5 BIG-IP, Fortinet FortiOS, or Cisco IOS XE instances are exposed to the internet without latest patches.
2. Review and restrict outbound traffic from servers: Webshell deployment and Cobalt Strike Beacon C2 require outbound connectivity. Restrict egress from server VLANs to approved destinations only.
3. Validate Active Directory hardening: Ensure LSASS protection (Credential Guard, RunAsPPL) is enabled. Restrict NTDS access. Monitor for unusual AD enumeration queries (Get-ADUser, Get-ADGroupMember, dsquery, dsget).
4. Tabletop exercise: Run a DORA Art. 24 digital operational resilience test simulating exploitation of CVE-2021-26855 or CVE-2024-36401 followed by SharkLoader deployment, to validate detection and response capabilities.

5. Indicators of compromise

md5  C559CC68986933200FD5D9E4388E2F58
md5  B3352B42432DEDC4A519F011DC8B5D5A
md5  24FCEBDEECBA65004FDB0923763D74FD
md5  9C872A0D5D5A38950E8B9AC9B488BE3F
md5  AA3086BE652C8B20B0B29B2730D57119
md5  A514D1BB62D7916475946FE7C07AC0AA
md5  9CBD560F820C95D7C38342CD558CB5C6
md5  1F65544978B8EA0E745E573B8EE9684B
md5  D98F568496512E4F98670C61C97CB07A
domain  connect-microsoft[.]com
domain  ms-record[.]com
domain  ms-record[.]top
domain  ms-tray[.]top
filename  GoogleUpdateStepup.exe
filename  AnyConnect-win-4.10.04071-predeploy-k9exe
filename  AutoUpdate.exe
filename  319-pfd-8001-reva_traitement biologique_master.zip
filename  SystemSettings.dll
filename  DscCoreR.mui
filename  SyncRes.dat
filename  SyncRest.dat
filepath  %APPDATA%\xwreg\
filepath  %APPDATA%\xgdf\
filepath  %APPDATA%\reports\AnyConnect-win-4.msi
filepath  %TEMP%\aswerf\
scheduled_task  \Microsoft\Windows\Edge\Edgeupdate
registry_key  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MFUpdate

6. Detection

YARA rule

rule SharkLoader_Loader_DLL {
    meta:
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://securelist.com/strikeshark-campaign/120326/"
        description = "Detects SharkLoader SystemSettings.dll and associated encrypted modules"
    strings:
        $sideloading_dll = "SystemSettings.dll" nocase ascii
        $encrypted_mui = "DscCoreR.mui" nocase ascii
        $syncres = "SyncRes.dat" nocase ascii
        $syncrest = "SyncRest.dat" nocase ascii
        $alt_mui1 = "GameInputInboxs32.mui" nocase ascii
        $alt_mui2 = "diagerr.xml" nocase ascii
        $alt_mui3 = "NtfsLog.etl" nocase ascii
        $alt_mui4 = "Ignored.Dat" nocase ascii
        $alt_mui5 = "VistaCompat.nls" nocase ascii
        $export_func1 = "SetUserProcessPriorityBoost" nocase ascii
        $export_func2 = "StartEngineData" nocase ascii
        $resource_name1 = "TELEMETRY" nocase ascii
        $resource_name2 = "VAULTSVCD" nocase ascii
        $resource_name3 = "UMRDPRDAT" nocase ascii
        $ldr_lock = "LdrpLoaderLock" nocase ascii
        $ldr_work = "LdrpWorkInProgress" nocase ascii
    condition:
        3 of them
}

rule SharkLoader_Dropper_Variants {
    meta:
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://securelist.com/strikeshark-campaign/120326/"
        description = "Detects SharkLoader dropper executables masquerading as legitimate software"
    strings:
        $dropper1 = "GoogleUpdateStepup.exe" nocase ascii
        $dropper2 = "AnyConnect-win-4.10.04071-predeploy-k9exe" nocase ascii
        $dropper3 = "AutoUpdate.exe" nocase ascii
        $dropper4 = "AnyConnect-win-4.msi" nocase ascii
        $path1 = "\\xwreg\\" nocase ascii
        $path2 = "\\xgdf\\" nocase ascii
        $path3 = "\\reports\\" nocase ascii
        $path4 = "\\aswerf\\" nocase ascii
        $immersive = "ImmersiveControlPanel" nocase ascii
        $shell_exec = "ShellExecuteW" nocase ascii
        $zlib = "zlib" nocase ascii
    condition:
        2 of them
}

Sigma rule

title: SharkLoader DLL Sideloading via SystemSettings.exe
id: 8f3a2c1d-4b5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects SystemSettings.exe executing from non-standard paths, indicating SharkLoader DLL sideloading
author: Adverse Trace
date: 2026/06/25
references:

    - https://securelist.com/strikeshark-campaign/120326/
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\SystemSettings.exe'
    filter_legitimate:
        Image: 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate SystemSettings.exe execution from non-standard paths (rare)
level: high

title: SharkLoader Scheduled Task Persistence
id: 9e4b3c2d-5c6f-7d8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects creation of scheduled tasks used by StrikeShark for SharkLoader persistence
author: Adverse Trace
date: 2026/06/25
references:

    - https://securelist.com/strikeshark-campaign/120326/
logsource:
    product: windows
    category: process_creation
detection:
    selection_task1:
        CommandLine|contains: '\Microsoft\Windows\Edge\Edgeupdate'
    selection_task2:
        CommandLine|contains|all:

            - 'schtasks'
            - '/create'
            - 'SystemSettings.exe'
    selection_com_task:
        CommandLine|contains|all:

            - 'ITaskScheduler'
            - 'SystemSettings.exe'
    condition: selection_task1 or selection_task2 or selection_com_task
falsepositives:

    - Legitimate Edge update scheduled task (verify path and execution context)
level: high

title: SharkLoader Registry Run Key Persistence
id: 0f5c4d3e-6d7f-8e9a-0b1c-2d3e4f5a6b7c
status: experimental
description: Detects creation of registry Run key used by StrikeShark for SharkLoader persistence
author: Adverse Trace
date: 2026/06/25
references:

    - https://securelist.com/strikeshark-campaign/120326/
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains|all:

            - 'reg add'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
            - 'MFUpdate'
            - 'SystemSettings.exe'
    condition: selection
falsepositives:

    - None known
level: high

title: StrikeShark Credential Dumping via Procdump or NTDSUtil
id: 1a6d5e4f-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects credential dumping techniques observed in StrikeShark campaign
author: Adverse Trace
date: 2026/06/25
references:

    - https://securelist.com/strikeshark-campaign/120326/
logsource:
    product: windows
    category: process_creation
detection:
    selection_procdump:
        Image|endswith: '\Procdump64.exe'
        CommandLine|contains: 'lsass.exe'
    selection_ntdsutil:
        Image|endswith: '\ntdsutil.exe'
        CommandLine|contains: 'ac i ntds'
    condition: selection_procdump or selection_ntdsutil
falsepositives:

    - Legitimate administrative use of procdump or ntdsutil (verify context)
level: high

title: StrikeShark Dropper Execution
id: 2b7e6f5a-8f9a-0b1c-2d3e-4f5a6b7c8d9e
status: experimental
description: Detects execution of known SharkLoader dropper filenames
author: Adverse Trace
date: 2026/06/25
references:

    - https://securelist.com/strikeshark-campaign/120326/
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:

            - '\GoogleUpdateStepup.exe'
            - '\AutoUpdate.exe'
    selection_cmdline:
        CommandLine|contains:

            - 'AnyConnect-win-4.10.04071-predeploy-k9exe'
            - '319-pfd-8001-reva_traitement biologique_master.zip'
    condition: selection or selection_cmdline
falsepositives:

    - Legitimate software with matching names (verify signature and path)
level: medium

CVE assessment

4 referenced CVEs — 3 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

7. Sources

• Kaspersky (Securelist), "StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader," https://securelist.com/strikeshark-campaign/120326/, published 2026-06-24T10:00:03+00:00.

8. Adverse Trace position

Severity assessment: HIGH. The campaign exploits three CISA KEV-listed vulnerabilities with CVSS scores of 9.1, 8.6, and 9.8 (all EPSS 100%), demonstrating reliable exploitation of critical internet-facing applications. SharkLoader's use of "Perfect DLL Hijacking," Blowfish/AES encryption, reflective loading, Microsoft Detours-based API hooking, and Sleep-based memory scanning evasion demonstrates a significant level of technical expertise. The broad geographic targeting (Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, Serbia) and sector diversity (government, diplomatic, software development) increases the probability of EMEA financial services exposure, particularly through opportunistic exploitation of unpatched Exchange or SharePoint instances. Attribution to a Chinese-speaking threat actor is low confidence and single-sourced (Kaspersky only); the actor "StrikeShark" has no MITRE ATT&CK profile — treat attribution as unconfirmed and verify before enforcement. No evidence of data exfiltration has been observed, but Cobalt Strike's file operation and data exfiltration modules could be employed at a later stage. Client-impact assessment: EMEA financial services clients with internet-facing Exchange, SharePoint, Openfire, or GeoServer instances should treat this as an active, immediate threat. The combination of CISA KEV-listed critical CVEs, publicly available PoC exploits, and internet-wide scanning activity by the threat actor means unpatched systems are at high risk of compromise. Clients should immediately patch all listed CVEs, block the four identified C2 domains, deploy the YARA and Sigma rules provided in §6, and hunt for the IOCs in §5. Next steps: Adverse Trace will continue to monitor for additional StrikeShark IOCs, infrastructure changes, and any confirmation of attribution. We will issue an updated advisory if data exfiltration is confirmed or if additional C2 infrastructure is identified.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.