Loading malware…
SharkLoader is a previously undocumented multi-stage Windows malware loader used in the StrikeShark intrusion campaign to deploy Cobalt Strike Beacon on compromised hosts. It has been observed in intrusions affecting government, diplomatic, and software-sector organizations across multiple countries, with victimology and post-compromise behavior consistent with broad opportunistic targeting and possible espionage-oriented objectives, although attribution remains unconfirmed. Some tooling used alongside the campaign has been associated with Chinese-speaking developers, but no definitive link to a known threat actor has been established.
SharkLoader is delivered after initial access obtained through exploitation of known vulnerabilities in internet-facing enterprise applications and appliances, and also through trojanized installers masquerading as legitimate software such as Cisco AnyConnect and Google Update. In server-side compromises, operators have also used webshell-based execution to launch the loader. The malware commonly abuses DLL sideloading with legitimate Windows binaries and uses the Perfect DLL Hijacking technique to execute malicious code while bypassing normal loader-lock constraints.
Its execution chain is designed for stealth. SharkLoader decrypts and reflectively loads additional stages in memory, ultimately launching Cobalt Strike Beacon without relying on a conventional on-disk payload chain. Reported variants use layered encryption, staged in-memory loading, API hooking, runtime-generated direct system calls, parent-process spoofing, and interference with Event Tracing for Windows to reduce visibility. It has also been observed modifying memory protections around the Beacon during sleep intervals to hinder memory-scanning detections.
SharkLoader itself functions primarily as a loader, while persistence in observed intrusions has been established by the operators through scheduled tasks, registry Run keys, and webshells rather than by an intrinsic SharkLoader persistence module. After deployment of the final payload, operators conducted reconnaissance, Active Directory enumeration, credential theft including LSASS dumping and NTDS extraction, and lateral movement using Cobalt Strike and additional post-exploitation tooling. The malware therefore serves as a stealthy bridge between initial compromise and broader post-exploitation activity in enterprise Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
The campaign leverages a multi-stage malware loader, referred to as SharkLoader, to deploy Cobalt Strike malware, a widely used post-exploitation framework.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cybersecurity researchers have uncovered a new malware loader called SharkLoader that is quietly slipping into networks by hiding inside fake software installers.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
To stick around, the operators set up persistence through scheduled tasks that run every five minutes, registry run keys, and additional scheduled tasks running with SYSTEM level privileges.
attackers deploy SharkLoader using techniques such as webshell-based command execution or malicious droppers
The malware hooks numerous Windows API calls and redirects them to raw system calls generated on the fly, helping it slip past tools watching for suspicious behavior.
To stick around, the operators set up persistence through scheduled tasks that run every five minutes, registry run keys, and additional scheduled tasks running with SYSTEM level privileges.
To stick around, the operators set up persistence through scheduled tasks that run every five minutes, registry run keys, and additional scheduled tasks running with SYSTEM level privileges.
The loader consists of multiple encrypted stages that decrypt and execute entirely in memory before ultimately deploying a Cobalt Strike Beacon.
By packaging SharkLoader inside installers branded to look like Cisco AnyConnect or Google Update, the attackers exploit the instinct to click familiar update prompts without a second thought.
The malware itself is designed to stay hidden: it disguises its components as ordinary Windows system files
The loader consists of multiple encrypted stages that decrypt and execute entirely in memory before ultimately deploying a Cobalt Strike Beacon.
SharkLoader incorporates reflective loading, custom encryption routines, packed payloads, and staged execution to minimize forensic artifacts and reduce visibility to endpoint security products.
goes to great lengths to disable the security logging that defenders rely on to detect intrusions
It also tampers with Event Tracing for Windows logging and spoofs parent process IDs, blending its activity into normal system noise.
The loader then decrypts and executes additional payloads directly in memory
They then move to reconnaissance, Active Directory enumeration, credential theft, LSASS memory dumping, and extraction of the NTDS database, classic steps toward controlling a network.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-stage malware loader used after exploitation of public-facing applications. It is deployed via webshell-based command execution or malicious droppers, abuses DLL side-loading with legitimate Windows binaries, decrypts and executes payloads in memory, and ultimately launches a Cobalt Strike Beacon.
A stealthy malware loader delivered via fake software installers such as Cisco AnyConnect and Google Update. It executes largely in memory, uses DLL side-loading and Perfect DLL Hijacking, hooks Windows APIs, tampers with ETW logging, spoofs parent process IDs, establishes persistence via scheduled tasks and registry run keys, and enables follow-on reconnaissance, credential theft, LSASS dumping, and NTDS extraction.
A multi-stage malware loader that decrypts and executes entirely in memory, using layered encryption, reflective loading, DLL side-loading, API hooking, ETW interference, PPID spoofing, and memory protection changes to stealthily deploy Cobalt Strike Beacon.
Previously undocumented loader malware used in the StrikeShark campaign to decrypt and load Cobalt Strike Beacon on compromised hosts. It is delivered via web shells or custom dropper executables disguised as legitimate software, uses Perfect DLL Hijacking to bypass Windows Loader Lock, and achieves persistence through Registry Run keys and scheduled tasks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.