StrikeShark SharkLoader Campaign Delivering Cobalt Strike

A previously undocumented intrusion cluster, designated StrikeShark, has been identified conducting a global campaign targeting diplomatic, government, and software development sectors. The actor utilizes a custom malware family named SharkLoader to deliver Cobalt Strike Beacons, primarily gaining initial access through opportunistic exploitation of vulnerabilities in internet-facing applications like Microsoft Exchange, SharePoint, and Openfire. Preliminary evidence, including the use of open-source tools developed by Chinese-speaking developers, suggests the actor is likely Chinese-speaking, though formal attribution to a known APT remains unconfirmed.

The attack chain is technically sophisticated, employing 'Perfect DLL Hijacking' to bypass Windows loader locks and utilizing extensive API hooking via the MinHook and Microsoft Detours libraries to evade memory scanning and EDR detection. Victims have been identified across numerous regions including Indonesia, Taiwan, Hong Kong, Lebanon, Colombia, and Serbia. The diverse targeting profile suggests an objective focused on either strategic cyber-espionage or broad information gathering.