SharkLoader Malware Uses Perfect DLL Hijacking to Execute Cobalt Strike in Memory

SharkLoader, used by an intrusion cluster tracked as StrikeShark to deliver Cobalt Strike Beacon entirely in memory across a wide international footprint.

The campaign combines opportunistic exploitation of exposed internet-facing infrastructure with custom droppers disguised as trusted installers to establish initial access, then relies on layered, memory-only execution techniques and “Perfect DLL Hijacking” to minimize forensic traces.

Initial access vectors are broad and unsophisticated: operators exploited a long list of publicly disclosed vulnerabilities in internet-facing services including Microsoft Exchange, SharePoint, Openfire, GeoServer, Fortinet, Cisco IOS XE, Apache Shiro, F5 BIG-IP, Hikvision, and Zimbra and used custom droppers masquerading as legitimate software such as Cisco AnyConnect and Google Update.

Once foothold is achieved, SharkLoader abuses trusted Windows binaries to perform DLL side-loading, frequently leveraging signed executables such as SystemSettings.exe to load a malicious SystemSettings.dll.

The loader itself is multi-stage and encrypted; each stage decrypts and executes in memory and never touches disk as a recognizable payload, culminating in an in-memory reflective load of Cobalt Strike Beacon.

This lateral masquerade reduces signature-based detection while executing under the security context of legitimate Windows components.

Kaspersky, which first published technical details, assesses with medium confidence that StrikeShark leverages publicly available proof-of-concept exploits rather than bespoke zero-days, enabling rapid compromise of vulnerable systems across Asia, Europe, the Middle East and Latin America.

Several advanced evasion techniques distinguish SharkLoader. Researchers observed implementation of the “Perfect DLL Hijacking” technique, which manipulates internal loader structures to create malicious threads without triggering the Windows loader lock during DLL initialization an approach that helps avoid typical loader-related artifacts.

SharkLoader Malware Uses DLL Hijacking

Complementing this, SharkLoader uses custom encryption, reflective loading, API hooking to redirect and invoke syscalls at runtime, interference with Event Tracing for Windows (ETW), PPID spoofing, and dynamic memory-protection adjustments around the embedded Beacon while the process sleeps.

These behaviors collectively reduce visibility to memory scanners and behavioral detection engines.

Persistence mechanisms vary by deployment and include scheduled tasks running at five-minute intervals, registry Run keys, and manually-created SYSTEM-level scheduled jobs.

Post-compromise activity observed by investigators typically involved reconnaissance, Active Directory enumeration, credential theft, LSASS dumping, and NTDS extraction before full Beacon-based post-exploitation and lateral movement using both load of Cobalt Strike beacon and open-source tools.

Confirmed victims encompass government-related organizations, diplomatic entities, software development firms, and additional sectors, suggesting potential intelligence-collection interests; however, researchers caution that evidence of data exfiltration is limited and confidence about targeting intent remains low.

The campaign’s widespread exploitation of known vulnerabilities also indicates a broadly opportunistic strategy rather than a narrowly targeted campaign.

From an intelligence perspective, StrikeShark demonstrates mature post-exploitation tradecraft built atop readily available offensive tooling, augmented by a stealthy custom loader designed to defeat endpoint and forensic controls.

While some observed tooling originates from Chinese-speaking developers, analysts found no conclusive code reuse or infrastructure overlap to support robust attribution; the assessment that operators may be Chinese-speaking is low confidence.

Defenders should prioritize rapid patching of internet-facing systems, hunt for anomalous DLL side-loading (notably SystemSettings.exe patterns), monitor for indicators of in-memory reflective loads, and employ memory-scanning and behavioral telemetry tuned to detect API-hooking and ETW interference.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.