【CyCraft Monthly Intelligence】StrikeShark Sweeps Globally: Threat Analysis on Deploying Cobalt Strike via Known Vulnerabilities

Threat and Impact

StrikeShark is a newly discovered intrusion campaign that primarily uses the custom SharkLoader malware loader to deploy Cobalt Strike Beacon on victim systems. What initially appeared to be an isolated incident at an Indonesian diplomatic organization was later found by researchers to be part of a much broader campaign spanning multiple countries and industries, indicating a larger and ongoing attack operation.

This campaign combines widespread opportunistic threats with potentially strategic targeted attacks. Researchers observed that attackers have been exploiting vulnerabilities in a range of Internet-facing enterprise applications and network devices, including Microsoft Exchange, SharePoint, Openfire, GeoServer, Fortinet, Cisco IOS XE, F5 BIG-IP, Zimbra, Apache Shiro, and Hikvision products. The attackers likely rely on publicly available proof-of-concept (PoC) exploits, allowing them to rapidly scale their attacks and sweep the Internet for exposed, unpatched systems. Internet-wide scanning activity linked to the attack infrastructure further confirms their intent to hunt for vulnerable organizations at scale.

At the same time, victimology shows the attackers have a strong, repeated interest in government, diplomatic, and software development organizations in Indonesia and Taiwan, with additional victims spread across Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. This pattern has raised concerns that the campaign may support espionage or intelligence-gathering activity, although its true intent cannot yet be fully confirmed.

Affected organizations may face significant impact. Once the attackers gain access, they establish persistence and deploy SharkLoader to launch Cobalt Strike Beacon, giving them a flexible foothold for reconnaissance, credential theft, lateral movement, and long-term access. Post-compromise activity includes enumerating Active Directory information, using WebShells and post-exploitation tools, and attempting to dump credentials from LSASS and the NTDS database. These actions allow the attackers to escalate privileges, move deeper into the environment, and compromise additional systems and accounts.

For affected industries, the risk is never limited to a single compromised host. Government and diplomatic entities may face risk of exposing sensitive internal communications, network architecture, and privileged credentials; software development firms may face threats to intellectual property, source code, internal documents, and trusted development infrastructure. Because this campaign also attacks opportunistically, any organization that exposes unpatched services to the public Internet is at risk, regardless of industry.

Analyst Perspective

The true scale of this campaign is likely far larger than what is currently known. The research team's visibility is limited to observed telemetry, and the attackers' frequent exploitation of public-facing application vulnerabilities suggests there may be many more undiscovered victims. Even where data exfiltration has not yet been confirmed, if the attackers retain Cobalt Strike access they keep the ability to launch further attacks, including data theft, remote command execution, and deeper network compromise.

Overall, StrikeShark is a high-risk campaign because it combines large-scale exploitation of known vulnerabilities with post-exploitation tactics suited for long-term persistence. The threat is especially significant for organizations that operate Internet-facing enterprise services, and for industries where the loss of data, credentials, orstrategic intelligence could trigger major operational or geopolitical consequences.

Technical Details

StrikeShark's intrusion chain combines opportunistic attacks with a technically mature, multi-stage malware loader. Atthe core of the campaign is the custom SharkLoader loader, which deploys CobaltStrike Beacon directly in memory, minimizing physical files left on disk and significantly increasing the difficulty of detection. In observed cases, attackers exploit Internet-facing application vulnerabilities and deliver custom droppers disguised as legitimate software to gain access. They then use WebShells, DLL Side-Loading, encrypted payload stages, reflective loading, API hooking, and stealth-focused memory operations to establish execution and maintain control.

Reconnaissance

Both before and after compromisinga system, the attackers gather information to identify viable targets and understand the victim environment.

Before compromise, the most notable behavior is Internet-wide scanning launched from IPs linked to the attackers' infrastructure. This strongly suggests the attackers are broadly searching for vulnerable enterprise software and devices, which is entirely consistent with the campaign's wide victim distribution and its repeated exploitation of public-facing application vulnerabilities.

After gaining access,the attackers use the following native commands to perform host and network reconnaissance:

‍

In more thorough intrusions (particularly in Active Directory environments), they expand their investigation using the following commands:

The attackers also use PowerShell and ADtools (including Get-ADGroupMember, Get-ADUser, dsquery, and dsget) to enumerate privileged groups and users. This shows the attackers are not just collecting local system details, but also mapping trust relationships, privileged accounts, and a potential map of systems for later use.

Resource Development

This campaign appears to rely heavily on external, off-the-shelf offensive resources rather than developing its own exploits. The research team assesses with moderate confidence that the attackers use public PoC exploits hosted on platforms such as GitHub to attack known vulnerabilities in enterprise systems.

The attackers also prepare related operational resources, including:

• Custom droppers disguised astrusted software such as Google Update or Cisco AnyConnect
• Decoy PDF documents embedded inthe dropper to trick users into executing it
• C2 domains, for example:
  
  • connect-microsoft[.]com
  • ms-record[.]com
  • ms-record[.]top
  • ms-tray[.]top

In addition, the attackers incorporate several open-source tools into their workflow, including FScan, Searchall, Pillager, SharpGPOAbuse, Microsoft Detours, and MinHook — indicating they assemble and adapt a practical tool chain from public resources suited for stealthy post-exploitation.

Initial Access

This campaign primarily uses two initial access vectors.

The first and primary vector isexploitation of Internet-facing application vulnerabilities. Observed vulnerable products include:

• Microsoft Exchange (including CVE-2021-26855 ProxyLogon and CVE-2022-41082)
• Microsoft SharePoint (CVE-2021-27076)
• Openfire (CVE-2023-32315)
• GeoServer (CVE-2024-36401)
• Apache Shiro (CVE-2016-4437)
• Hikvision products (CVE-2021-36260)
• Zimbra Collaboration Suite (CVE-2022-27925)
• F5 BIG-IP (CVE-2023-46747)
• Fortinet FortiOS (CVE-2024-21762, CVE-2022-40684)
• Cisco IOS XE Web UI (CVE-2023-20198)
• React Server Components (CVE-2025-55182).

This set of vulnerabilities shows that the root cause of many intrusions is not a Zero-day or rare weakness, but organizations exposing unpatched systems directly to the Internet.

The second vector is delivery via droppers. Custom droppers disguise themselves as legitimate installers or documents, with filenames such as:

• GoogleUpdateStepup.exe
• AnyConnect-win-4.10.04071-predeploy-k9.exe
• AutoUpdate.exe
• 319-pfd-8001-reva_traitementbiologique_master.zip.

Some samples also use document-themed lures, such as naming executables to look like PDFs. In one Taiwan-related sample, the filename was in Chinese and used a .pdf.exe double extension, combining social engineering with executable delivery.

Execution

How execution begins varies by access vector, but all paths ultimately converge on the same SharkLoader execution chain.

In exploitation cases, the attackers upload components via a WebShell, then launch a legitimate Windows binary to trigger DLL Side-Loading. A common approach is copying and executing SystemSettings.exe:

‍

This technique works because the attackers place a malicious SystemSettings.dll in the same directory. When SystemSettings.exe runs, Windows loads the attacker-controlled DLL instead of only trusted components.

In dropper cases, the execution process is more complex: one sample embedded a legitimate Cisco AnyConnect MSI installer in its resource section. The dropper operates as follows:

• Decompress zlib-compressed data from its resources
• Write the decompressed file to %APPDATA%\reports\AnyConnect-win-4.msi
• Execute the MSI via ShellExecuteW
• Simultaneously drop the SharkLoader components into another %APPDATA% directory in the background.

This dual-purpose behavior makes the malware appear completely legitimate to the victim, while secretly deploying the real malicious payload.

Other droppers extract a decoy PDF from a resource named TELEMETRY, write it to %TEMP% or %TEMP%\aswerf, and launch it via cmd.exe /c. This social-engineering layer distracts the user while installation is complete.

Execution then proceeds into SharkLoader's multi-stage architecture:

•  SystemSettings.exe: the legitimate Side-Loading target
• SystemSettings.dll: the main SharkLoader DLL
• DscCoreR.mui: the encrypted second-stage module
• SyncRes.dat / SyncRest.dat: the encrypted third-stage DLL
• Final payload: Cobalt StrikeBeacon.

One key technical detail is that SharkLoader does not simply load a DLL and spawn the Beacon; instead, it uses an advanced process centered on “Perfect DLL Hijacking.”

Once SystemSettings.dll is loaded, SharkLoader manipulates undocumented internal Windows loader mechanisms in ntdll.dll, including:

• LdrpLoaderLock
• LdrpWorkInProgress

It uses LeaveCriticalSection to forcibly release the loader lock, InterlockedDecrement64 to decrement the loader state, and SetEvent to signal completion, before safely creating a new thread from the DllMain path. This technique is critical, because calling thread-creation APIs from within DllMain normally risks deadlock due to the Windows loader lock; SharkLoader deliberately manipulates the loader's internal state specifically to bypass this restriction and continue execution.

Persistence

Persistence mechanisms vary by intrusion vector.

After exploiting public-facing application vulnerabilities, the attackers establish persistence through a WebShell on the compromised server. Although researchers did not recover the actual file, command telemetry and detection results both indicate the attackers used this method.

In dropper infection cases, persistence is built directly into the installer logic. The dropper creates two scheduled tasks via the Task Scheduler COM interface:

• OneDrive Standalone UpdateTask-S-1-5-21-...
• MicrosoftUpdateTaskUserS-1-5-32-...

Both point to a copy of SystemSettings.exe located in an attacker-controlled directory (such as %APPDATA%\xwreg or %APPDATA%\xgdf).

The first task runs every 5 minutes, providing stable persistence.

The second task runs every second, ensuring immediate execution right after installation; it is deleted after about 1.5 seconds, leaving only the long-term task.

In other observed incidents, the attackers also established persistence manually:

• Registry Run key:
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MFUpdate
• Scheduled task:
  \Microsoft\Windows\Edge\Edgeupdate

These mechanisms ensure the Side-Loading chain restarts SharkLoader after a system reboot or user login.

Privilege Escalation

While the current intelligence does not show a dedicated local privilege escalation exploit, the attackers use mechanisms that provide high-privilege execution or otherwise help obtain elevated privileges.

For example, configuring a scheduled task to run with SYSTEM privileges:

‍

This allows SharkLoader to execute in a highly privileged context.

The attackers also target high-value credentials by dumping LSASS memory and the NTDS database. In practice, these operations let the attackers obtain and reuse administrator- or domain-level credentials, supporting privilege escalation.

Defense Evasion

Defense evasion is one of the most technically notable features of this incident.

First, the malware abuses legitimate binaries for DLL Side-Loading, particularly SystemSettings.exe, but also variant targets involving msedge.dll, PrintDialog.dll, andmiracastview.dll. This lets the malicious code execute under the guise of normal Windows or application behavior.

Second, the attackers make extensive use of masquerading:

• Fake installer names (e.g.,Google Update, Cisco AnyConnect)
• Directory names resembling security vendors (e.g., KasperskyLab)
• Decoy PDFs to distract the victim.

Third, SharkLoader uses encryption and in-memory loading techniques to hide its individual stages:

• DscCoreR.mui uses Blowfish encryption in ECB mode, with the file's first 16 bytes serving as the decryption key.
• SyncRes.dat uses AES-128 encryption, with the first 16 bytes as the key and the next 16 bytes as the IV.

Once decrypted, both payloads are written directly into memory via reflective loading rather than back to disk. Both also erase the MZ header to hinder static analysis and signature-based detection.

The reflective loading logic manually performs the following steps: parsing the PE header, allocating memory, aligning sections, applying relocations, resolving the import table, setting memory protections, and finally transferring execution to the in-memory image. This loader design significantly reduces forensic artifacts left ondisk.

Another particularly notable evasion feature is SharkLoader's use of “Perfect DLL Hijacking” to manipulate loader internal state, allowing it to safely continue execution from DllMain without exposing the malware through obvious instability.

In addition, the malware installs extensive API hooks using Microsoft Detours and MinHook.

The decrypted SyncRes.dat DLL hooksa large set of Windows APIs, covering the following functionality:

• Process creation
• Token and privilege handling
• Memory allocation and protection
• Thread creation and APC injection
• DLL loading and process resolution
• File mapping
• File I/O
• ETW and event logging.

Particularly notable:

• CreateProcessA/W hooks cause child processes to be spawned under svchost.exe rather than the original process hosting the malware, masking post-exploitation activity.
• EtwEventWrite, EventWriteEx,and EventWrite hooks may interfere with or reduce telemetry generation.

SharkLoader also registers a Vectored Exception Handler (VEH) specifically to monitor for memory access violations (0xC0000005). When triggered, it uses VirtualProtect to restore the faulting memory page to RWX (read/write/execute) permissions and resumes execution. Although no such exceptions were observed during analysis, the mechanism is clearly designed to maintain runtime stability for protected or tampered memory regions.

Finally, DscCoreR.mui decompresses and loads MinHook to hook VirtualAlloc and Sleep. These hooks directly support the Beacon's stealthy execution:

• The VirtualAlloc hook records the address and size of the first three successful allocations related to Beacon memory.
• The Sleep hook changes the permissions of these tracked regions from PAGE_EXECUTE_READWRITE (RWX) toPAGE_READWRITE (RW) before the Beacon sleeps, restoring them to RWX upon waking.

This is a sophisticated anti-memory-scanning technique that effectively reduces the exposure ofexecutable, writable memory during idle periods.

Credential Access

The attackers attempt to steal credentials using native and legitimate tools.

Researchers observed two keycommands:

The first command creates an Install From Media (IFM) copy of the NTDS database, which may expose ActiveDirectory password hashes. The second command dumps LSASS memory, a common method for recovering credentials from memory.

These actions are technically significant, showing the attackers moving from an initial foothold to credential harvesting to expand control within the domain.

Discovery

After entering the system, the attackers conduct extensive internal discoveries, using native commands and PowerShell to enumerate:

• Host configuration
• Running services and processes
• Network connections
• Shared resources
• Logged-in users
• AD users, groups, and computers
• High-value administrator groups
• Remote file paths and webdirectories.

Examples include:

Using tools such as FScan, Searchall, and Pillager further extends this capability, showing the attackers want both broad situational awareness and targeted discovery of sensitive information.

Lateral Movement

While the current intelligence provides limited direct evidence of remote code execution on other hosts, itclearly shows the attackers' preparation for lateral movement.

The attackers enumerate remote administrative shares and directories (such as \\c$) and collect information on domain users, computers, and privileged groups — common preparatory steps for lateral movement using harvested credentials.

Credential dumping plays a keyrole here. The research team explicitly notes that dumping LSASS and NTDS supports lateral movement, privilege escalation, and deeper compromise.

The use of SharpGPOAbuse also shows the attackers' interest in domain-level mechanisms, which can facilitate propagation or remote execution by manipulating Group Policy.

Collection

Collection activity in this campaign focuses on gathering system, domain, and credential data rather than confirmed document theft.

The attackers use:

• Search all to locate sensitive information
• Pillager to gather information
• Native commands to enumerate environment details
• AD queries to collect user, group, and computer information
• ntdsutil and Procdump64.exe to collect credential data.

This shows the collection phase focuses mainly on operational intelligence gathering and expanding access, rather than immediate data theft.

Command and Control (C2)

SharkLoader's ultimate purpose is to deploy Cobalt Strike Beacon as the campaign's primary C2 implant.

Once the final stage is ready, DscCoreR.mui performs the following:

• Create a thread in a suspended state
• Decompress the embedded zlib-compressed Beacon shellcode
• Write the shellcode into memory
• Call ResumeThread to resume the thread.

This allows the Beacon to run entirely in memory.

Associated attack infrastructure includes the following domains:

• connect-microsoft[.]com
• ms-record[.]com
• ms-record[.]top
• ms-tray[.]top.

The malware's memory hooks on VirtualAlloc and Sleep are specifically designed to help the Beacon stay stealthy while maintaining its C2 lifecycle, particularly during sleep intervals.

Impact

Although this campaign shows no destructive behavior, some actions have directly impacted system integrity and security controls.

Using SharpGPOAbuse to modify Group Policy Objects can alter enterprise configurations and grant broader control over the victim environment.

At the malware level, SharkLoaderalso manipulates normal process and memory behavior, thereby undermining system integrity:

• Forcing child processes to appear under svchost.exe
• Modifying memory permissions around Beacon execution
• Modifying Windows loader state to allow continued execution from DllMain.

While these actions are not destructive in the traditional sense, they do alter system behavior to serve the attackers' interests and undermine trust in normal operating system and logging mechanisms.

In summary, the technical core ofthe StrikeShark incident is a carefully engineered, layered execution chain: opportunistic exploitation or social-engineering delivery triggers SharkLoader installation; SharkLoader abuses DLL Side-Loading and loader-lock manipulationto run safely; encrypted stages are decrypted and reflectively loaded inmemory; API hooks and memory protection tricks skillfully evade detection; and Cobalt Strike Beacon is ultimately launched as the operator's interactive foothold. It is this combination of commodity intrusion techniques with advanced in-memory execution that makes this campaign both easy to replicate at scale and difficult to detect.

Mitigation

Mitigating the StrikeShark threat requires focusing on the two most exposed links in the attack chain: initial access via unpatched vulnerabilities, and post-compromise persistence and credential theft.

Reduce Exposure of Internet-Facing Services

This campaign repeatedly abuses Internet-facingenterprise applications and devices, so the top priority is identifying, patching, and hardening all externally exposed systems. Based on the incidents described, organizations should promptly review:

• Microsoft Exchange
• Microsoft SharePoint
• Openfire
• GeoServer
• Fortinet FortiOS
• Cisco IOS XE Web UI
• F5 BIG-IP
• Zimbra Collaboration Suite
• Apache Shiro
• Hikvision products.

Because the attackers rely heavily on known vulnerabilities with public exploit code, timely patching and risk management are two of the most effective defenses. This directly affects infrastructure teams responsible for:

• Mail services
• Collaboration portals
• VPN and firewall appliances
• Web application servers
• Enterprise platforms connected to authentication.

If patches cannot be applied immediately, organizations should implement interim hardening measures, such as:

• Limit Internet exposure
• Restrict access to trusted IPranges
• Place vulnerable services behind a VPN or reverse proxy
• Increase monitoring of these assets
• Segment high-risk systems from sensitive internal network segments.

Monitor WebShells and Anomalous Server-Side Activity

After successful exploitation, the attackers reportedly use WebShells for follow-on activity. Defenders should therefore inspect compromised or exposed servers for:

• Unusual files in web directories
• Web server processes executing unusual commands
• Suspicious child processess pawned by Exchange, SharePoint, Openfire, or other application services
• Unusual file uploads to writable directories (such as C:\ProgramData or user profile paths).

This mitigation mainly affects:

• IIS and application server administrators
• SOC and DFIR (digital forensicsand incident response) teams
• File Integrity Monitoring (FIM) and EDR configuration.

Detect DLL Side-Loading and Living-off-the-Land Binary Abuse

A notable feature of this campaign is abusing legitimate executables such as SystemSettings.exe to side-loadmalicious DLLs. Organizations should monitor for:

• SystemSettings.exe running from unusual locations (such as C:\ProgramData, %APPDATA%, or custom directories)
• Suspicious companion files,such as SystemSettings.dll, DscCoreR.mui, and SyncRes.dat
• Similar Side-Loading behavior involving msedge.dll, PrintDialog.dll, or miracastview.dll
• Legitimate Windows binaries copied out of their original directory and executed from user-writable paths.

This may require tuning EDR, application control, and threat-hunting content to flag:

• Renamed or relocated signed binaries
• DLLs loaded from unusual paths
• Execution chains initiated by trusted binaries from non-standard directories.

These controls mainly affect:

• Endpoint protection policy
• Allowlisting rules
• SOC detection engineering
• Windows server and workstation monitoring.

Hunt Persistence via Scheduled Tasks and Run Keys

StrikeShark operators use scheduled tasks and registry Run keys to maintain access. Organizations should review systems for:

• Scheduled tasks mimicking Microsoft, OneDrive, Edge, or update-related names
• Tasks launching binaries from %APPDATA%, C:\ProgramData, or other user-writable locations
• Frequent task execution patterns, such as running every few minutes
• Run keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to suspicious copies of SystemSettings.exe.

This measure affects:

• Windows endpoint and server administration
• Group Policy auditing
• Startup persistence monitoring
• EDR and SIEM detection.

Strengthen Defenses Against Credential Theft and Lateral Movement

Post-compromise activities include Active Directory enumeration, LSASS dumping, and attempts to access the NTDS database. To reduce the impact after initial compromise, organizations should:

• Restrict administrative privileges
• Restrict interactive logon to sensitive servers
• Monitor and block suspicious use of tools such as procdump and ntdsutil, and credential-dumping behavior
• Protect LSASS wherever possible
• Monitor access to domain controller backups and NTDS-related files
• Review use of administrative shares and remote enumeration activity.

Special attention should be paid to:

• Domain controllers
• Exchange and SharePoint servers
• Jump servers
• Privileged administrator workstations.

This will affect:

• Active Directory security configuration
• Privileged Access Management (PAM)
• Credential protection controls
• Lateral movement detection playbooks.

Improve Detection of In-Memory Malware and Cobalt Strike Activity

SharkLoader ultimately deploys CobaltStrike Beacon and uses reflective loading, API hooking, and memory protection changes to evade detection. Since much of this activity may leave no traditional file-on-disk artifacts, organizations should ensure their EDR andSOC workflows can detect:

• In-memory module loading
• Suspicious thread creation and resume actions
• Abnormal VirtualAlloc,VirtualProtect, and Sleep patterns
• ETW tampering or event-suppression attempts
• Child processes appearing to spawn under unexpected parent processes (such as svchost.exe).

This mitigation mainly affects:

• EDR telemetry collection
• Memory scanning strategy
• Behavior-based detection
• Threat hunting focused on Beacon behavior.

Guard Against Malicious Droppers and Disguised Installers

Some infections use custom droppersdisguised as Google Update, Cisco AnyConnect, AutoUpdate, or document-themed files. To reduce this risk:

• Restrict execution from %TEMP%and %APPDATA% where feasible
• Adopt application allowlisting
• Inspect unsigned or unusual installers
• Educate users to verify software sources and stay alert to update-themed executables and double-extension files (such as .pdf.exe)
• Monitor processes that open decoy documents while covertly dropping files.

This mainly affects:

• End-user endpoint policy
• Software distribution controls
• Social engineering and user security awareness programs
• Application execution restrictions.

Use IOCs and Threat Hunting to Support Response

Organizations should also operationalize published threat indicators, including:

• Known malware Hashes
• Suspicious domains, such asconnect-microsoft[.]com, ms-record[.]com, ms-record[.]top, and ms-tray[.]top
• Filenames and paths associated with SharkLoader components
• Suspicious task names and persistence indicators.

IOC matching alone is not sufficient, but it helps quickly identify known infections and prioritize response.

Practical Response Priorities

For security defenders, the most urgentactions right now are:

• Patch and audit all Internet-facing applications and devices
• Check external-facing servers for WebShells and suspicious scheduled tasks
• Hunt for anomalous execution of SystemSettings.exe and related side-loaded DLLs
• Review domain controllers and critical servers for credential-dumping activity
• Monitor for Cobalt Strike-like memory behavior and suspicious outbound communications.

In short, mitigating this incident cannot be limited to removing malware from endpoints; it requires a fully coordinated response across Internet-facing infrastructure, Windows persistence controls, endpoint detection, Active Directory protection, and threat hunting.

‍

IoCs（Indicator of Compromise）

‍Malicious Domains

Files

CVEs

‍File Paths

‍

Reference

• StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
• 中國駭客從事攻擊行動 StrikeShark，臺灣有政府機構名列受害範圍
• New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

‍