StrikeShark Campaign Uses SharkLoader to Deploy Cobalt Strike Beacon
Summary
Kaspersky reports that StrikeShark uses SharkLoader to deploy Cobalt Strike Beacon after exploiting public-facing applications or using malicious droppers. The campaign targets organizations in multiple countries; no active data exfiltration has been observed.
Key points
- Kaspersky tracks the campaign as StrikeShark and reports targets including diplomatic, government, and software development organizations across multiple countries.
- Reported initial access routes include Exchange Server flaws CVE-2021-26855 and CVE-2021-27076, Openfire CVE-2023-32315, and GeoServer CVE-2024-36401.
- The operators use web shells and DLL side-loading to deliver SharkLoader, or custom droppers disguised as legitimate installers; some droppers use decoy PDFs.
- SharkLoader decrypts and loads DscCoreR.mui, which decompresses and launches Cobalt Strike Beacon in a suspended thread.
- The malware uses API hooks involving Microsoft Detours and MinHook; the Sleep hook may help evade memory scanning, according to Kaspersky.
- Post-compromise activity includes persistence through Registry Run keys and scheduled tasks, Active Directory enumeration, and credential theft targeting LSASS and the NTDS database.
- Kaspersky reports no active data exfiltration observed so far; the campaign’s goals remain unclear, and attribution to a Chinese-speaking actor is an assessment rather than a confirmed identification.
Article Details
- Attack Vectors
- The campaign used known vulnerabilities in Exchange Server, Openfire, and GeoServer for initial access, including CVE-2021-26855, CVE-2023-32315, and CVE-2024-36401.
- After gaining access, operators deployed web shells and used a DLL side-loading chain involving SystemSettings.exe and SystemSettings.dll to deliver SharkLoader.
- Custom droppers masqueraded as legitimate software installers or applications, including Google Update and Cisco AnyConnect. Some droppers used decoy PDFs to encourage victims to open the malicious file.
- SharkLoader decrypted and decompressed components used to load Cobalt Strike Beacon into a suspended thread; hooks on VirtualAlloc and Sleep were used during Beacon execution.
- Operators used Registry Run keys and scheduled tasks to launch SystemSettings.exe, including at user logon.
- Post-compromise activity included Active Directory enumeration, credential theft targeting LSASS and the NTDS database, and use of FScan, Searchall, and Pillager.
MITRE ATT&CK
T1003.001 · LSASS MemoryCredential theft included targeting the LSASS process.T1003.003 · NTDSCredential theft included targeting the NTDS database file.T1036 · MasqueradingCustom droppers masqueraded as legitimate software installers or applications, including Google Update and Cisco AnyConnect.T1053.005 · Scheduled TaskOperators used scheduled tasks to activate SystemSettings.exe.T1140 · Deobfuscate/Decode Files or InformationSharkLoader decrypted and decompressed components used to load Cobalt Strike Beacon.T1190 · Exploit Public-Facing ApplicationThe campaign gained initial access by exploiting vulnerabilities in Exchange Server, Openfire, and GeoServer.T1204.002 · Malicious FileSome droppers used decoy PDFs to persuade victims to open the malicious file.T1505.003 · Web ShellOperators deployed web shells after gaining a foothold.T1547.001 · Registry Run Keys / Startup FolderOperators used Registry Run keys to activate SystemSettings.exe.T1574.002 · DLL Side-LoadingA DLL side-loading chain involving SystemSettings.exe and SystemSettings.dll delivered SharkLoader.
CVE
CVE-2021-26855involve the two initial access pathways: the exploitation of known Exchange Server flaws, such as CVE-2021-26855 (aka ProxyLogon), to strike the Indonesian diplomatic entity, or through a path traversalCVE-2021-27076Upon gaining a foothold, the threat actors establish persistence by deploying web shells to trigger a DLL side-loading chain involving “SystemSettings.exe” (CVE-2021-27076) to deliver SharkLoader (“SystemSettings.dll”).CVE-2023-32315the Indonesian diplomatic entity, or through a path traversal vulnerability impacting Openfire (CVE-2023-32315) in the case of Taiwanese software development organizations, or a critical remote code execution bugCVE-2024-36401Taiwanese software development organizations, or a critical remote code execution bug in GeoServer (CVE-2024-36401) to target a Colombian organization.
People
Malware
Products
Cisco AnyConnectexecutables masquerading as legitimate software installers or applications like Google Update and Cisco AnyConnect, and executing the malware loader once the installation process completes.GeoServer#StrikeSharkGoogle Updateis via custom dropper executables masquerading as legitimate software installers or applications like Google Update and Cisco AnyConnect, and executing the malware loader once the installation process completes.Microsoft Exchange ServerInitial access is gained by exploiting flaws in Exchange Server, Openfire, and GeoServer.Microsoft Windowsby security researcher Elliot Killick in October 2023, to execute malicious code while bypassing Windows Loader Lock, a system-wide lock held by the operating system when loading and unloading DLLs.Openfire#StrikeShark
Tools
Cobalt StrikeA newly observed campaign tracked as StrikeShark is delivering the previously undocumented SharkLoader malware to deploy Cobalt Strike Beacon on compromised systems.fscanactor or group, although the operators have utilized several open-source post-compromise tools like FScan and Pillager, commonly put to use by Chinese-speaking developers.Microsoft DetoursSyncRes.dat, which installs multiple Windows API hooks by using the Microsoft Detours library to monitor exceptions generated during runtime.MinHookMinHook DLL, which installs API hooks for the VirtualAlloc and Sleep functions to copy the decompressed Cobalt Strike Beacon into the allocated memory region using VirtualAlloc.Pillageror group, although the operators have utilized several open-source post-compromise tools like FScan and Pillager, commonly put to use by Chinese-speaking developers.Searchallthe NTDS database file, and deploying open-source scanners and information gathering tools like FScan, Searchall, and Pillager.
Countries
Colombiamultiple countries, and entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Hong Kongdevelopment companies across multiple countries, and entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Indonesiathe activity under the moniker StrikeShark, said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan, software development companies across multiple countries, andLebanoncompanies across multiple countries, and entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Nepalentities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.North Macedoniaand entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Serbiaassociated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Syriaacross multiple countries, and entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Taiwansaid the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan, software development companies across multiple countries, and entities associated with other sectors
Industries
DiplomaticThe campaign has targeted diplomatic, government, and software development organizations across several countries.GovernmentThe campaign has targeted diplomatic, government, and software development organizations across several countries.Software developmentThe campaign has targeted diplomatic, government, and software development organizations across several countries.