During a recent investigation into activity affecting a diplomatic mission in Indonesia, researchers uncovered a previously undocumented loader family they named SharkLoader.
What began as an isolated incident rapidly expanded into a multi-country campaign tracked as StrikeShark where SharkLoader consistently serves as the initial loader that ultimately deploys a Cobalt Strike Beacon on compromised hosts.
Observed infection vectors include exploitation of internet-facing services (Microsoft Exchange, SharePoint, Openfire, GeoServer and others) and malware-style droppers masquerading as legitimate installers, indicating the actor combines opportunistic scanning with targeted intrusions.
SharkLoader’s delivery methods are varied. In several cases the actor exploited known public-facing vulnerabilities examples include CVE-2021-26855 (ProxyLogon) against Exchange, CVE-2023-32315 on Openfire, and a GeoServer flaw (CVE-2024-36401).
Investigators assessed with medium confidence that the attacker relies heavily on publicly available proof-of-concept exploits, supplemented by internet-wide scanning from infrastructure tied to the campaign.
When exploitation succeeds, the actor typically installs webshells and abuses legitimate Windows binaries for DLL sideloading. A recurring chain uses SystemSettings.exe copied to ProgramData or AppData and a malicious SystemSettings.dll that implements the SharkLoader logic.
Kaspersky said in a report shared with GBhackers, the campaign also leverages a broad set of RCE and auth-bypass flaws across enterprise appliances and applications (Apache Shiro, F5 BIG-IP, Fortinet FortiOS, Zimbra, Microsoft SharePoint and others).
The threat actor used a legitimate Cisco AnyConnect VPN installer as a lure. The custom dropper extracted zlib-compressed data embedded within its resource section, decompressed it into an MSI package.
Other side-loading targets (msedge.dll, PrintDialog.dll, miracastview.dll) and decoy filenames demonstrate adaptability. In dropper scenarios, the actor embeds compressed MSI or PDF decoys inside resources, launches the legitimate installer to mask execution, and quietly places SharkLoader components into %APPDATA% directories before triggering the sideload.
SharkLoader Malware to Deploy Cobalt Strike
SharkLoader itself is modular. The main DLL (SystemSettings.dll) performs an advanced “Perfect DLL Hijacking” trick to escape the Windows loader lock, create threads safely from DllMain, and then decrypt and reflectively load encrypted modules (notably DscCoreR.mui and SyncRes.dat).
DscCoreR.mui contains a compressed Cobalt Strike Beacon and the MinHook library; SyncRes.dat installs extensive API hooks using Microsoft Detours.
Hooks include VirtualAlloc, Sleep, CreateProcess*, GetProcAddress, and multiple syscall-level redirections implemented via jitasm, enabling PPID spoofing, ETW suppression, and dynamic memory-protection toggling that helps evade memory-scanning defenses.
The loader decrypts DscCoreR.mui using a Blowfish key embedded in the module, then decrypts SyncRes.dat using an AES-128 key and IV stored in its header; both PE images lack MZ headers and are unpacked and mapped in memory to avoid disk artifacts.
The Blowfish cipher by using custom P-array and S-box constants embedded in the loader and decrypts the file in ECB mode with the extracted key.
The malware creates a suspended thread for the beacon, writes decompressed beacon shellcode into the buffer, then resumes the thread yielding an in-memory Cobalt Strike Beacon with persistence typically provided by scheduled tasks or registry Run keys.
Victimology spans government organizations, a diplomatic mission, and multiple software firms across Taiwan, Indonesia, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, Serbia and more suggesting a geographically broad and mixed-target campaign that blends opportunistic vulnerability exploitation with potential espionage objectives.
Post-compromise activity centers on reconnaissance and credential theft (LSASS and NTDS dumping), Active Directory enumeration, and use of Chinese-language open-source post-exploitation tools (FScan, Searchall, Pillager, SharpGPOAbuse), though analysts found no definitive code or infrastructure overlap to attribute StrikeShark to an established APT.
The technical sophistication loader lock manipulation, reflective PE loading, layered encryption, Detours/Jitasm-based syscall evasion, MinHook memory tricks and the deployment of Cobalt Strike make this campaign a high-risk activity requiring rapid detection and containment.
Organizations should prioritize patching exposed internet-facing services, monitor for anomalous scheduled tasks and unusual use of legitimate binaries, enable LSASS protections, and hunt for in-memory Beacon indicators.
For detailed CVE references and technical indicators, see advisories from vendors and public reports documenting CVE-2021-26855, CVE-2022-41082, CVE-2023-32315 and others linked to this campaign.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
