StrikeShark Campaign Uses SharkLoader to Deploy Cobalt Strike
Summary
Researchers detail StrikeShark, a campaign using SharkLoader to deploy Cobalt Strike through exploited public-facing applications and malicious droppers. Analysis describes its in-memory loading, evasion, persistence and credential-theft activity; attribution remains a低
Key points
- Researchers identified SharkLoader, a previously undocumented loader that deploys Cobalt Strike Beacon, in activity affecting government, diplomatic and software development organizations across multiple countries.
- Observed initial-access methods included exploiting internet-facing applications such as Exchange, Openfire and GeoServer, as well as custom droppers disguised as installers or PDF documents.
- SharkLoader uses DLL sideloading and manipulates Windows loader state to bypass the loader lock; encrypted modules are decrypted and reflectively loaded in memory.
- The malware installs API hooks, including hooks that suppress ETW logging and alter memory protections around Cobalt Strike Beacon activity, which researchers say may help evade memory scanning.
- Post-compromise activity included persistence through scheduled tasks or a registry Run key, system and Active Directory reconnaissance, and attempts to dump credentials from LSASS and the NTDS database.
- Researchers found no direct code or infrastructure links to a known actor. A Chinese-speaking threat-actor assessment is preliminary and low confidence; no clear evidence of data exfiltration had been observed.
Article Details
- Attack Vectors
- Exploitation of internet-facing applications, including Microsoft Exchange (CVE-2021-26855 and CVE-2021-27076), Openfire (CVE-2023-32315), and GeoServer (CVE-2024-36401).
- Custom droppers disguised as legitimate software installers or applications, and in some cases as PDF documents, delivered SharkLoader components.
- DLL sideloading through legitimate executables, including SystemSettings.exe, to load malicious SharkLoader DLLs.
- Webshells were used for post-exploitation activity; the researchers suspect components were uploaded through a webshell.
- Persistence through scheduled tasks and a Windows registry Run key.
- Defensive Notes
- The researchers recommend heightened vigilance and continued monitoring of this activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | comms-record[.]comms-record[.]top | Listed by the article as C2 or related campaign infrastructure. |
| DOMAIN | connect-microsoft[.]com | Listed by the article as C2 or related campaign infrastructure. |
| DOMAIN | ms-record[.]com | Listed among indicators associated with the StrikeShark campaign. |
| DOMAIN | ms-record[.]top | Listed among indicators associated with the StrikeShark campaign. |
| DOMAIN | ms-tray[.]top | Listed by the article as C2 or related campaign infrastructure. |
| MD5 | 1f65544978b8ea0e745e573b8ee9684b | Hash of a SharkLoader dropper sample found on a machine in Lebanon. |
| MD5 | 24fcebdeecba65004fdb0923763d74fd | Hash of a malicious dropper used to deploy SharkLoader components in a campaign targeting a government entity in Taiwan. |
| MD5 | 9c872a0d5d5a38950e8b9ac9b488be3f | Hash of a SharkLoader DLL sample. |
| MD5 | 9cbd560f820c95d7c38342cd558cb5c6 | Hash of an encrypted SharkLoader component. |
| MD5 | a514d1bb62d7916475946fe7c07ac0aa | Hash of an encrypted SharkLoader component. |
| MD5 | aa3086be652c8b20b0b29b2730d57119 | Hash of a SharkLoader DLL sample. |
| MD5 | b3352b42432dedc4a519f011dc8b5d5a | Dropper sample hash listed among the campaign indicators. |
| MD5 | c559cc68986933200fd5d9e4388e2f58 | Installer sample hash listed among the campaign indicators. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe attacker attempted to dump LSASS memory using Procdump64.exe.T1003.003 · NTDSThe attacker used ntdsutil to create a copy of the NTDS database for credential access.T1016 · System Network Configuration DiscoveryThe attacker used ipconfig /all, netstat -ano, and arp -a to gather network configuration and connectivity information.T1018 · Remote System DiscoveryThe attacker used net share and directory listings of administrative shares such as c$ to discover network resources.T1027 · Obfuscated Files or InformationSharkLoader used encrypted, compressed, and packed modules, including PE files with removed MZ headers.T1036 · MasqueradingDroppers were disguised as legitimate installers or applications, including Google Update and Cisco AnyConnect.T1053.005 · Scheduled TaskThe dropper created scheduled tasks to execute SystemSettings.exe, including a task configured to run every five minutes.T1057 · Process DiscoveryThe attacker ran tasklist commands to enumerate processes and search for the malware process.T1069.002 · Domain GroupsThe attacker queried Active Directory groups, including Domain Controllers and Enterprise Admins.T1082 · System Information DiscoveryThe attacker ran systeminfo to collect system information.T1105 · Ingress Tool TransferDroppers wrote SharkLoader components to victim systems; the researchers also suspected components were uploaded through a webshell.T1106 · Native APIThe malware used direct system calls and Windows APIs for process, memory, and loader operations.T1190 · Exploit Public-Facing ApplicationThe operators exploited internet-facing applications, including Microsoft Exchange, Openfire, and GeoServer, to gain access.T1547.001 · Registry Run Keys / Startup FolderIn a Hong Kong incident, the attacker created a registry Run key to launch SystemSettings.exe at user logon.T1574.001 · DLLLegitimate executables such as SystemSettings.exe were used to sideload malicious DLLs, including SystemSettings.dll.
CVE
CVE-2021-26855[CVE identifiers ] Exploited vulnerabilities – CVE-2021-26855, CVE-2023-32315, and 2 more items.CVE-2021-27076Microsoft SharePoint: CVE-2021-27076CVE-2023-32315(‘the threat actor exploited Microsoft Exchange vulnerabilities’ / ‘exploitation of Openfire (CVE-2023-32315)’ / ‘exploited a GeoServer instance vulnerable to CVE-2024-36401’).CVE-2024-36401/ ‘exploitation of Openfire (CVE-2023-32315)’ / ‘exploited a GeoServer instance vulnerable to CVE-2024-36401’).
People
Threat Actors
Malware
Cobalt Strike BeaconResearchers uncovered SharkLoader, a previously undocumented malware family used in the StrikeShark campaign to deploy Cobalt Strike Beacon through exploitation of public-facing applications and malicious droppers.SharkLoaderResearchers uncovered SharkLoader, a previously undocumented malware family used in the StrikeShark campaign to deploy Cobalt Strike Beacon through exploitation of public-facing applications and malicious droppers.
Products
Cisco AnyConnectbenign (‘masquerading as legitimate software installers or applications such as Google Update and Cisco AnyConnect’ / ‘used security product vendor names as the directory names’).GeoServerInitial access was often achieved by exploiting internet-facing applications such as Microsoft Exchange, Microsoft SharePoint, Openfire, GeoServer, and other enterprise products.Microsoft ExchangeInitial access was often achieved by exploiting internet-facing applications such as Microsoft Exchange, Microsoft SharePoint, Openfire, GeoServer, and other enterprise products.Microsoft SharePointInitial access was often achieved by exploiting internet-facing applications such as Microsoft Exchange, Microsoft SharePoint, Openfire, GeoServer, and other enterprise products.Microsoft Windows[T1106 ] Native API – The malware used direct syscalls and Windows APIs to carry out loader, memory, and process operations (‘redirects the API call to a direct NtOpenProcessToken syscall stub’ / ‘uses … directOpenfireInitial access was often achieved by exploiting internet-facing applications such as Microsoft Exchange, Microsoft SharePoint, Openfire, GeoServer, and other enterprise products.
Tools
Cobalt StrikeResearchers uncovered SharkLoader, a previously undocumented malware family used in the StrikeShark campaign to deploy Cobalt Strike Beacon through exploitation of public-facing applications and malicious droppers.fscanopen-source tools used during the campaign revealed that several reconnaissance tools, including FScan, Searchall, and Pillager, were developed by individuals identified as Chinese speaking developers onPillagerused during the campaign revealed that several reconnaissance tools, including FScan, Searchall, and Pillager, were developed by individuals identified as Chinese speaking developers on GitHub.Procdump64[T1003.001 ] OS Credential Dumping: LSASS Memory – Credentials were targeted by dumping LSASS memory (‘Procdump64.exe -accepteula -ma lsass.exe’).Searchallopen-source tools used during the campaign revealed that several reconnaissance tools, including FScan, Searchall, and Pillager, were developed by individuals identified as Chinese speaking developers on GitHub.SharpGPOAbuseWe also detected the use of SharpGPOAbuse by the threat actor, a tool designed to modify Group Policy Objects within Active Directory environments.
Countries
ColombiaThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.Hong KongThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.IndonesiaThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.LebanonThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.NepalThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.North MacedoniaThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.SerbiaThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.SyriaThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.TaiwanThe campaign, tracked as StrikeShark, affected organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.
Industries
GovernmentThe activity targeted diplomatic, government, and software development organizations across multiple countries, with tactics including DLL sideloading, API hooking, persistence, and credential theft.Software developmentThe activity targeted diplomatic, government, and software development organizations across multiple countries, with tactics including DLL sideloading, API hooking, persistence, and credential theft.