StrikeShark
StrikeShark is a tracked intrusion cluster associated with the previously undocumented SharkLoader malware family. Researchers identified the activity during an investigation into a diplomatic organization in Indonesia and observed additional infections affecting government, diplomatic, software development, and other organizations across Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, Serbia, and other countries, indicating broad and partly opportunistic targeting. SharkLoader is used to deploy Cobalt Strike Beacon on compromised systems. Observed initial access included exploitation of internet-facing applications and delivery via custom droppers disguised as legitimate software such as Google Update and Cisco AnyConnect. Reported exploited vulnerabilities included Microsoft Exchange CVE-2021-26855 and CVE-2022-41082, Microsoft SharePoint CVE-2021-27076, Openfire CVE-2023-32315, GeoServer CVE-2024-36401, Apache Shiro CVE-2016-4437, Hikvision CVE-2021-36260, Zimbra Collaboration Suite CVE-2022-27925, F5 BIG-IP CVE-2023-46747, Fortinet FortiOS CVE-2024-21762 and CVE-2022-40684, and Cisco IOS XE Web UI CVE-2023-20198. Researchers assessed with medium confidence that the actor primarily relied on publicly available proof-of-concept exploits. One IP associated with a StrikeShark C2 domain was also observed conducting internet-wide scanning. Technically, SharkLoader abuses DLL sideloading using legitimate binaries such as SystemSettings.exe, and variants also used targets including msedge.dll, PrintDialog.dll, and miracastview.dll. The malware uses encrypted multi-stage modules, reflective loading, API hooking, ETW suppression, and memory-evasion techniques while launching Cobalt Strike Beacon in memory. Reported behavior included use of the Perfect DLL Hijacking technique, Blowfish and AES decryption of staged components, Microsoft Detours, MinHook, jitasm-generated direct syscalls, hooking of EtwEventWrite, EventWriteEx, EventWrite, VirtualAlloc, and Sleep, and PPID spoofing. Persistence included webshell deployment after exploitation, scheduled tasks, and registry Run keys such as MFUpdate and \Microsoft\Windows\Edge\Edgeupdate. Post-compromise activity included reconnaissance, Active Directory enumeration, credential dumping from LSASS with Procdump64, NTDS extraction with ntdsutil, and use of FScan, Searchall, Pillager, SharpGPOAbuse, Cobalt Strike, and webshells. Attribution remains preliminary. Researchers stated they found no direct code reuse, infrastructure overlap, or operational similarity sufficient to attribute StrikeShark to any known APT or cybercrime group. Based on the use of several open-source tools associated with Chinese-speaking developers, they assessed with low confidence that StrikeShark is a Chinese-speaking threat actor. Known associated malware name: SharkLoader.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.
Beyond these incidents, we identified additional exploitation activity targeting vulnerabilities in multiple internet-facing enterprise applications and network appliances including those listed below: Remote Code Execution (RCE) Apache Shiro: CVE-2016-4437
In the incident affecting an Indonesian diplomatic entity, the threat actor exploited Microsoft Exchange vulnerabilities, including CVE-2021-26855 (ProxyLogon), to gain access to the target environment.
Beyond these incidents, we identified additional exploitation activity targeting vulnerabilities in multiple internet-facing enterprise applications and network appliances including those listed below: Remote Code Execution (RCE) Microsoft SharePoint: CVE-2021-27076
Beyond these incidents, we identified additional exploitation activity targeting vulnerabilities in multiple internet-facing enterprise applications and network appliances including those listed below: Remote Code Execution (RCE) Hikvision Products: CVE-2021-36260
Beyond these incidents, we identified additional exploitation activity targeting vulnerabilities in multiple internet-facing enterprise applications and network appliances including those listed below: Remote Code Execution (RCE) Zimbra Collaboration Suite: CVE-2022-27925
8 more CVEs tied to this actor tracked in Mallory.
Observables
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly identified intrusion cluster conducting broad opportunistic and strategic intrusions across multiple countries and sectors, using exploitation of internet-facing applications and custom droppers to deploy SharkLoader, which in turn loads Cobalt Strike Beacon. Activity includes persistence via scheduled tasks and registry Run keys, webshell deployment, reconnaissance, Active Directory enumeration, credential dumping, and stealth through API hooking and ETW suppression.
Previously undocumented intrusion cluster using SharkLoader to deploy Cobalt Strike Beacon, exploiting internet-facing applications and using malicious droppers against government organizations, diplomatic entities, software development companies, and other sectors across multiple countries.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.