A newly identified cyber espionage campaign tracked as StrikeShark shows how advanced threat actors keep combining public facing vulnerability exploitation, malicious software installers, and stealth memory loading techniques to quietly establish long term access inside high value enterprise environments.

Security researchers have linked the activity to a previously undocumented malware family named SharkLoader, a custom loader designed specifically to deploy a Cobalt Strike Beacon while evading conventional endpoint detection.

A Globally Distributed Targeting Campaign

Researchers tracking the activity observed victims spanning multiple sectors and geographic regions, which points to a broad opportunistic campaign rather than a narrowly focused operation. Confirmed targets include a diplomatic organization in Indonesia, government entities in Taiwan, internationally operating software development firms, and organizations located in Hong Kong, Lebanon, Syria, Colombia, Serbia, Nepal, and North Macedonia.

Although direct attribution remains inconclusive, several operational artifacts suggest the operators may be Chinese speaking threat actors. Investigators identified post compromise tooling such as FScan and Pillager, both utilities commonly seen in offensive frameworks developed and used within Chinese speaking threat ecosystems.

The campaign reflects an increasingly common operational pattern among sophisticated attackers. Rather than relying entirely on proprietary malware families, they lean on publicly available exploit code, commodity offensive frameworks, and custom loaders that stitch these pieces together.

Initial Access Through Internet Facing Vulnerabilities

StrikeShark operators primarily rely on vulnerable, externally exposed enterprise applications to establish their initial foothold. Researchers observed multiple exploitation paths targeting both legacy and recently disclosed vulnerabilities affecting widely deployed infrastructure systems.

Among the exploited vulnerabilities was CVE-2021-26855 (ProxyLogon), which enabled the compromise of Microsoft Exchange infrastructure belonging to a diplomatic organization in Indonesia. In separate incidents, attackers exploited CVE-2023-32315, a path traversal vulnerability affecting Openfire collaboration servers, and CVE-2024-36401, a remote code execution flaw impacting GeoServer deployments.

Additional vulnerabilities weaponized during the campaign include weaknesses affecting Apache Shiro, Microsoft SharePoint, Zimbra Collaboration Suite, Fortinet FortiOS appliances, Cisco IOS XE Web UI, F5 BIG-IP infrastructure, Hikvision network devices, and the ProxyNotShell Microsoft Exchange chain made up of CVE-2022-41040 and CVE-2022-41082.

The breadth of this exploit set strongly suggests the attackers are continuously scanning internet facing infrastructure for known weaknesses and rapidly weaponizing publicly available proof of concept exploit code published on GitHub and open source research platforms.

When Web Shells Become the First Persistence Layer

Once exploitation succeeds, the attackers deploy web shells that provide persistent remote execution capability on compromised servers. From there the campaign shifts into a DLL side loading execution chain built around the legitimate Windows binary SystemSettings.exe.

The attackers copy this trusted binary to a new location and place a malicious DLL named SystemSettings.dll alongside it. The DLL appears legitimate to Windows but actually serves as the delivery mechanism for SharkLoader. Because the executing binary is a trusted Microsoft process, security monitoring tools often classify the behavior as benign or low risk.

This stage reflects a growing trend in modern intrusions, where legitimate operating system components are abused to conceal malicious execution and make behavioral detection significantly harder.

Malicious Installers and Weaponized File Delivery

Researchers identified a second distribution channel involving custom built droppers disguised as legitimate software installers. Samples observed during the campaign impersonated trusted applications including Google Update and Cisco AnyConnect.

Several droppers also presented decoy PDF documents to convince victims that the executable served a legitimate business purpose. In some cases the PDF acts purely as visual deception while the embedded malware silently deploys SharkLoader in the background.

This technique reinforces a persistent reality across modern attack campaigns. No matter how sophisticated the malware becomes later in the intrusion chain, many compromises still begin with a seemingly harmless file downloaded or opened by a user.

Perfect DLL Hijacking and Memory Based Execution

After execution, SharkLoader employs a relatively advanced technique known as Perfect DLL Hijacking, originally documented by security researcher Elliot Killick in October 2023.

The method manipulates the internal loader state of the process to release the Windows loader lock, a synchronization control normally responsible for managing DLL loading and unloading operations inside Windows processes. By releasing it, the loader can safely create a malicious thread through the CreateThread API without triggering the deadlocks that usually occur when threads are spawned from within DllMain.

Internally, SharkLoader decrypts a secondary payload named DscCoreR.mui, which decompresses and stages a Cobalt Strike Beacon payload inside a newly created suspended thread.

Two supporting components assist the operation. The first, SyncRes.dat, uses the Microsoft Detours library to hook Windows APIs and intercept runtime exceptions. The second relies on the MinHook framework to intercept calls to functions including VirtualAlloc and Sleep.

The Sleep API interception appears specifically designed to evade modern memory scanners that search for suspicious executable memory pages. Once all memory preparation is complete, SharkLoader resumes the suspended thread using the ResumeThread API, activating the Beacon while minimizing visible behavioral indicators.

Reconnaissance Begins Immediately After Compromise

Once persistence is established, the operators begin extensive internal reconnaissance. Investigators observed Active Directory enumeration, privilege discovery, and credential harvesting focused heavily on Windows authentication infrastructure.

The attackers target the LSASS process to extract active credentials from memory while also attempting to access the NTDS.dit database, the central repository containing Active Directory password hashes.

Open source reconnaissance tools including FScan, Searchall, and Pillager are deployed to map internal systems, identify administrative privileges, discover reachable servers, and prepare for lateral movement across the environment.

Although researchers have not yet observed large scale exfiltration, the deployment of Cobalt Strike strongly suggests espionage objectives, intellectual property theft, or preparation for deeper long term persistence operations.

Why FileDNA CADR Matters Earlier in the Attack Chain

The StrikeShark campaign illustrates an important security gap that modern enterprise defenses frequently overlook. Most organizations focus heavily on detecting malware after execution through EDR platforms, behavioral analytics, and threat hunting infrastructure.

In this campaign, however, the attackers repeatedly rely on an earlier and far simpler attack surface, which is the file itself.

Malicious installers disguised as trusted software packages, weaponized PDF decoys, DLL side loading payloads, and embedded loader components all depend on one initial event, namely a file entering the environment and being executed before downstream security controls fully understand its intent.

This is where technologies such as FileDNA Content Analysis, Disarm and Reconstruction (CADR) become increasingly important.

Rather than waiting for malware execution, CADR operates upstream by deeply analyzing the structure of the file itself. Embedded scripts, suspicious executable objects, hidden active content, malicious links, weaponized containers, DLL based payload components, and dangerous file structures can be identified and neutralized before the file ever reaches the endpoint.

In campaigns like StrikeShark, preventing malicious installers or weaponized document payloads from ever reaching execution may stop the intrusion chain long before Cobalt Strike, credential theft, persistence mechanisms, or lateral movement ever begin.

Modern attackers continue to evolve their post exploitation techniques, but their operations still depend heavily on trusted file delivery mechanisms. Stopping the file often means stopping the entire attack.

The Bigger Security Lesson

StrikeShark demonstrates a pattern that is becoming increasingly common across advanced threat campaigns in 2026. Sophisticated attackers no longer need custom zero days for every operation. Public exploits, trusted Windows binaries, memory only execution frameworks, and weaponized file delivery mechanisms provide more than enough capability to compromise high value targets quietly.

Organizations that invest exclusively in reactive detection layers are increasingly defending systems only after attackers have already gained code execution.

The more strategic defensive approach moves prevention further upstream, directly to the content, file, and application layer where these campaigns still begin.

References