Loading story…
Researchers identified a previously undocumented malware family, SharkLoader, during an intrusion affecting a diplomatic organization in Indonesia and linked it to a broader campaign tracked as StrikeShark. The loader was used to deliver Cobalt Strike Beacon after attackers exploited internet-facing applications including Microsoft Exchange, SharePoint, Openfire, and GeoServer, and also through custom droppers disguised as legitimate software such as Google Update and Cisco AnyConnect. Victims spanned government, diplomatic, software development, and other sectors in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, Serbia, and additional countries, suggesting broad and partly opportunistic targeting.
SharkLoader used DLL sideloading, encrypted multi-stage modules, reflective loading, API hooking, ETW suppression, PPID spoofing, and memory-protection changes to evade detection while launching Beacon in memory. The operators established persistence with scheduled tasks and registry Run keys, then carried out reconnaissance, Active Directory enumeration, and credential dumping with tools including FScan, Searchall, Pillager, SharpGPOAbuse, Procdump64, and ntdsutil. Researchers said attribution remains preliminary, but the use of several open-source tools associated with Chinese-speaking developers led to a low-confidence assessment that the campaign was conducted by a Chinese-speaking threat actor.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Based on the use of several open-source tools associated with Chinese-speaking developers, researchers assessed with low confidence that StrikeShark is a Chinese-speaking threat actor. The attribution was described as preliminary.
During an investigation into activity affecting a diplomatic organization in Indonesia, researchers identified a previously undocumented malware family named SharkLoader and tracked the broader intrusion cluster as StrikeShark. They found the campaign used exploitation of internet-facing applications and custom droppers to deliver Cobalt Strike Beacon across multiple countries and sectors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
11 references tracked. Mallory keeps watching after this page renders.
hkcert.org
Open sourcecybersecuritynews.com
Open sourceblog.polyswarm.io
Open sourcescworld.com
Open sourcecommunity.gurucul.com
Open sourcemalware.news
Open sourceelliotonsecurity.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers published detailed analyses of **Cobalt Strike** loaders, shellcode, and beacon traffic, showing how attackers continue to wrap the framework in diverse delivery chains including malicious DLLs, `.hta` files, `.vbs` scripts, CACTUSTORCH payloads, and Nim-based stagers. Across the samples, the loaders commonly used `VirtualAlloc`, `VirtualProtect`, `CreateThread`, `WriteProcessMemory`, and WinINet APIs, while shellcode was frequently hidden with XOR, Base64, 3DES, or custom obfuscation and then resolved APIs dynamically through PEB traversal and **ROR13-style API hashing**. Reported command-and-control indicators included `116.62[.]138.47`, `195.211.98[.]91`, `51.79.49[.]174:443`, and `42.193.229.33:12342`, with several samples using legacy Internet Explorer-style user agents and HTTP downloader or reverse-beacon behavior. The reporting also highlighted defender opportunities in memory and configuration analysis rather than static signatures alone. Analysts demonstrated extracting decrypted shellcode with hardware breakpoints, entropy-guided reverse engineering in Ghidra, and emulation in SpeakEasy, while other work showed how to recover or decrypt **Beacon** metadata and task traffic from leaked RSA keys or process memory. Additional hunting indicators included the named pipe pattern `\\.\pipe\MSSE-%d-server`, suspicious execution chains such as `mshta.exe` spawning child processes, and memory artifacts such as decoded payload stages, page-permission changes, and writable-memory key material. Together, the research shows that although Cobalt Strike payloads are heavily obfuscated and delivered through varied loaders, their in-memory behavior, decryption routines, and beacon communications remain practical points for detection and investigation.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
A spearphishing campaign attributed with high confidence to **Tropic Trooper** targeted employees at Chinese companies with a housing fund-themed lure that delivered a ZIP archive containing a disguised `.lnk` shortcut, a decoy Excel file, a hidden `&Recycle.Bin` folder, a legitimate McAfee-signed executable, a malicious DLL, and an encrypted payload. When the shortcut was opened, the malware chain launched the signed executable through **DLL side-loading**, displayed the decoy document, copied files into `C:\Users\Public\Downloads`, renamed `NTUSER.EXE` to `AVIRA.EXE`, and decrypted `setting.dat` to reflectively load a **Cobalt Strike Beacon** into memory.
Aug 15, 2026