CVE Tools
Track your stack

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

Kaspersky SecurelistBy Fareed Radzi25 min read

ResearchSharkLoaderCobalt Strike

Our summary

Kaspersky reports a previously undocumented malware family, SharkLoader, linked to a broader activity tracked as StrikeShark, which deploys Cobalt Strike Beacon on compromised systems. Initial access was observed by exploiting internet-facing products such as Microsoft Exchange (CVE-2021-26855) and Openfire (CVE-2023-32315), as well as other targets including CVE-2024-36401; the article also lists additional affected RCE/auth-bypass issues across multiple vendors (e.g., Apache Shiro CVE-2016-4437, Microsoft SharePoint CVE-2021-27076, Fortinet FortiOS CVE-2024-21762, Cisco IOS XE Web UI CVE-2023-20198). This matters because the activity combines public exploit code, webshell-based persistence, and DLL side-loading techniques to move quickly from intrusion to Cobalt Strike deployment across many countries and sectors.

Read at Kaspersky Securelist

Below is the opening; the full story is at Kaspersky Securelist.

From Kaspersky Securelist

Introduction

During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader. What initially appeared to be an isolated case quickly expanded into a broader campaign as we identified additional SharkLoader infections across multiple countries and sectors.…

Continue at Kaspersky Securelist
  1. The Hacker NewsNew SharkLoader Malware Deploys Cobalt Strike in StrikeShark CyberattacksCVE-2016-4437, CVE-2021-26855 +12
  2. SecurityWeekThai Broadband Provider Hacked via Fortinet VulnerabilityCVE-2023-46747, CVE-2024-21762
  3. Qualys Security BlogFortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate DevicesCVE-2022-40684, CVE-2024-21762
  4. ESET WeLiveSecurityBeware the SparroWock: The backdoor that bites, the commands that catchCVE-2021-26855
  5. The Hacker NewsThree Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and WipersCVE-2021-26855
  6. The Hacker News3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber CredentialsCVE-2024-21762
  7. The Hacker NewsGeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal BackendsCVE-2024-36401
  8. The Hacker NewsFBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. OrganizationsCVE-2021-26855
  9. The Hacker NewsUAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux RootkitCVE-2022-27925
  10. Cisco TalosUAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operationsCVE-2022-27925

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store