SharkLoader
SharkLoader is a previously undocumented malware loader identified by Kaspersky in the broader StrikeShark intrusion campaign. Its primary role is to deploy Cobalt Strike Beacon on compromised Windows systems. Researchers first identified it while investigating activity targeting a diplomatic organization in Indonesia, and related activity was observed against government, diplomatic, software development, and other organizations in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.
Observed delivery included exploitation of internet-facing applications and custom droppers masquerading as legitimate software such as Cisco AnyConnect and Google Update. Reported exploited products and vulnerabilities associated with the broader campaign included Microsoft Exchange (including CVE-2021-26855 and CVE-2022-41082), Openfire (CVE-2023-32315), GeoServer (CVE-2024-36401), Apache Shiro (CVE-2016-4437), Hikvision (CVE-2021-36260), Microsoft SharePoint (CVE-2021-27076), Zimbra (CVE-2022-27925), F5 BIG-IP (CVE-2023-46747), Fortinet FortiOS (CVE-2022-40684 and CVE-2024-21762), React Server Components (CVE-2025-55182), and Cisco IOS XE Web UI (CVE-2023-20198). Some droppers also displayed decoy PDF documents while silently installing the malware.
Technically, SharkLoader abuses DLL side-loading, commonly via the legitimate Windows binary SystemSettings.exe loading a malicious SystemSettings.dll. Variants also used alternative sideloading targets including msedge.dll, PrintDialog.dll, and miracastview.dll. The malware uses the Perfect DLL Hijacking technique, decrypts staged components such as DscCoreR.mui and SyncRes.dat/SyncRest.dat, and loads Cobalt Strike Beacon in memory. Reported cryptographic details include Blowfish decryption of DscCoreR.mui and AES-128 decryption of SyncRes.dat. SharkLoader also installs API hooks using Microsoft Detours and MinHook, including hooks on VirtualAlloc and Sleep to reduce memory-scanning visibility, and suppresses ETW logging by hooking EtwEventWrite, EventWriteEx, and EventWrite.
SharkLoader itself does not contain built-in persistence in all observed cases, but the associated intrusion activity used web shells, Registry Run keys, and scheduled tasks to relaunch the sideloading chain. Observed task and persistence artifacts included scheduled tasks executing SystemSettings.exe, a Run key named MFUpdate, and a scheduled task named \Microsoft\Windows\Edge\Edgeupdate. Post-compromise activity included reconnaissance, Active Directory enumeration, credential theft from LSASS and the NTDS database, and use of tools such as FScan, Searchall, Pillager, SharpGPOAbuse, Procdump64, ntdsutil, Cobalt Strike, and web shells.
Attribution remains unconfirmed. Kaspersky reported no direct code or infrastructure overlap with known threat groups, but assessed with low confidence that the operators may be Chinese-speaking based on use of open-source post-compromise tools associated with Chinese-speaking developers. Reported indicators of compromise associated with the campaign included domains connect-microsoft.com, ms-record.com, ms-record.top, and ms-tray.top, and hashes including C559CC68986933200FD5D9E4388E2F58, B3352B42432DEDC4A519F011DC8B5D5A, 24FCEBDEECBA65004FDB0923763D74FD, 9C872A0D5D5A38950E8B9AC9B488BE3F, AA3086BE652C8B20B0B29B2730D57119, A514D1BB62D7916475946FE7C07AC0AA, and 9CBD560F820C95D7C38342CD558CB5C6.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Microsoft SharePoint: CVE-2021-27076 ... Upon gaining a foothold, the threat actors establish persistence by deploying web shells to trigger a DLL side-loading chain involving "SystemSettings.exe" (CVE-2021-27076) to deliver SharkLoader ("SystemSettings.dll"). | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Cisco IOS XE Web UI: CVE-2023-20198 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Apache Shiro: CVE-2016-4437 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Fortinet FortiOS: CVE-2022-40684 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - F5 BIG-IP: CVE-2023-46747 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - React Server Components: CVE-2025-55182 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Fortinet FortiOS: CVE-2024-21762 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Hikvision Products: CVE-2021-36260 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
...or a critical remote code execution bug in GeoServer (CVE-2024-36401) to target a Colombian organization. | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
...or through a path traversal vulnerability impacting Openfire (CVE-2023-32315) in the case of Taiwanese software development organizations... | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Attack chains involve the two initial access pathways: the exploitation of known Exchange Server flaws, such as CVE-2021-26855 (aka ProxyLogon), to strike the Indonesian diplomatic entity. | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Microsoft Exchange Server: CVE-2022-41082 (aka ProxyNotShell) | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below - Zimbra Collaboration Suite: CVE-2022-27925 | A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
we uncovered a previously undocumented malware family that we have named SharkLoader. Our investigation revealed that SharkLoader serves as a loader designed to deploy Cobalt Strike Beacon on compromised systems.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Attack chains involve the two initial access pathways: the exploitation of known Exchange Server flaws, such as CVE-2021-26855 (aka ProxyLogon)... or through a path traversal vulnerability impacting Openfire (CVE-2023-32315)... or a critical remote code execution bug in GeoServer (CVE-2024-36401)... Other remote code execution and authentication bypass vulnerabilities weaponized by the threat actor are listed below...
Execution
3 techniques
Execution
While SharkLoader does not come with persistence mechanisms built into it, the threat actor has been found to leverage Registry Run keys and scheduled tasks as a way to activate the launch of "SystemSettings.exe"...
Persistence
4 techniques
Persistence
While SharkLoader does not come with persistence mechanisms built into it, the threat actor has been found to leverage Registry Run keys and scheduled tasks as a way to activate the launch of "SystemSettings.exe"...
Registry Run key : In the incident that affected an organization in Hong Kong, the attacker manually created a registry Run key to launch SystemSettings.exe upon user logon. The following command was used: reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "MFUpdate"
Privilege Escalation
4 techniques
Privilege Escalation
While SharkLoader does not come with persistence mechanisms built into it, the threat actor has been found to leverage Registry Run keys and scheduled tasks as a way to activate the launch of "SystemSettings.exe"...
Specifically, it's engineered to decrypt and load "DscCoreR.mui," which is then used to decompress and load Cobalt Strike in a new thread created in a suspended state... Finally... the malware calls the ResumeThread API to resume the suspended thread and begin execution of the beacon.
Stealth
11 techniques
Stealth
A second method used by StrikeShark to distribute the loader is via custom dropper executables masquerading as legitimate software installers or applications like Google Update and Cisco AnyConnect...
The malware itself is designed to stay hidden: it disguises its components as ordinary Windows system files
Specifically, it's engineered to decrypt and load "DscCoreR.mui," which is then used to decompress and load Cobalt Strike in a new thread created in a suspended state... Finally... the malware calls the ResumeThread API to resume the suspended thread and begin execution of the beacon.
goes to great lengths to disable the security logging that defenders rely on to detect intrusions
The second fired every second immediately after deployment, then was removed after about 1.5 seconds
Researchers observed parent process ID spoofing as well, making malicious child processes appear as if they were launched by the legitimate svchost.exe process.
One of those modules, DscCoreR.mui, is decrypted using a Blowfish cipher and contains the Cobalt Strike Beacon shellcode. Another module, SyncRes.dat, uses AES-128 encryption
One of the earliest observed actions involved copying the legitimate Windows application SystemSettings.exe to a new location before executing it... This application was later abused as part of a DLL sideloading chain used to launch SharkLoader.
The second hook, on the Sleep API, is used when Cobalt Strike Beacon calls Sleep... It temporarily modifies the memory protection of the tracked allocation regions... before invoking the original Sleep function. After the sleep period ends, the malware restores the memory protection... This behavior suggests that the malware developer implemented this mechanism to evade memory scanning techniques
Defense Impairment
1 technique
Defense Impairment
Registry Run key : In the incident that affected an organization in Hong Kong, the attacker manually created a registry Run key to launch SystemSettings.exe upon user logon. The following command was used: reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "MFUpdate"
Discovery
1 technique
Discovery
The second hook, on the Sleep API, is used when Cobalt Strike Beacon calls Sleep... It temporarily modifies the memory protection of the tracked allocation regions... before invoking the original Sleep function. After the sleep period ends, the malware restores the memory protection... This behavior suggests that the malware developer implemented this mechanism to evade memory scanning techniques
Command and Control
1 technique
Command and Control
IOCs tracked for this family
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously undocumented loader malware used to deploy Cobalt Strike Beacon on compromised systems. It is delivered via DLL side-loading and custom droppers masquerading as legitimate installers, uses Perfect DLL Hijacking to execute code, decrypts and loads additional components, and helps evade memory scanning through API hooking before resuming the beacon thread.
A previously unknown dropper/loader used in the StrikeShark campaign. It is disguised as legitimate software such as a Cisco AnyConnect VPN installer or Google Update utility, can display decoy PDF documents, installs a Cobalt Strike beacon, disguises components as Windows system files, abuses a legitimate Windows application for loading, and attempts to disable security logging to evade detection.
A newly discovered multi-stage loader delivered via fake software installers. It uses DLL sideloading, scheduled-task persistence, in-memory decryption/execution, API hooking, ETW evasion, and parent PID spoofing to load follow-on payloads while avoiding detection.
Previously undocumented malware loader used in the StrikeShark campaign to deploy follow-on payloads, specifically Cobalt Strike Beacon, via exploitation of internet-facing applications and malware-based infection chains.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.