{"id":3831,"date":"2026-06-24T10:04:05","date_gmt":"2026-06-24T10:04:05","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/24\/strikeshark-investigating-a-new-campaign-delivering-cobalt-strike-through-sharkloader\/"},"modified":"2026-06-24T10:04:05","modified_gmt":"2026-06-24T10:04:05","slug":"strikeshark-investigating-a-new-campaign-delivering-cobalt-strike-through-sharkloader","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/24\/strikeshark-investigating-a-new-campaign-delivering-cobalt-strike-through-sharkloader\/","title":{"rendered":"StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader"},"content":{"rendered":"
\n

\"\"<\/p>\n

Introduction<\/h2>\n

During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader<\/strong>. What initially appeared to be an isolated case quickly expanded into a broader campaign as we identified additional SharkLoader infections across multiple countries and sectors.<\/p>\n

Our investigation revealed that SharkLoader serves as a loader designed to deploy Cobalt Strike Beacon on compromised systems. We observed the threat actor deploying SharkLoader through exploitation of internet-facing applications, including Microsoft Exchange, Microsoft SharePoint, and Openfire Server, as well as through malware-based delivery mechanisms.<\/p>\n

Beyond the diplomatic entity in Indonesia, we identified related activity targeting government organizations in Taiwan, software development companies across multiple countries, and entities in other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, Serbia, and more. The observed victimology suggests a campaign with broad geographic reach and a diverse target set rather than a narrow focus on a specific industry or region.<\/p>\n

For now, we are tracking this activity as StrikeShark<\/strong>. Although the operators utilize several open-source post-compromise tools associated with Chinese-speaking developers, we have not identified direct code reuse, infrastructure overlap, or operational similarity to confidently attribute the activity to any known APT or cybercrime group. As a result, attribution remains preliminary and the campaign\u2019s ultimate objectives are still under research.<\/p>\n

Initial infection<\/h2>\n

Our analysis of SharkLoader intrusions indicates that the threat actor employs multiple methods to gain initial access to victim environments. During our investigation, we observed two primary infection vectors: the exploitation of vulnerabilities in internet-facing applications and the deployment of custom dropper samples, some of which were disguised as legitimate software.<\/p>\n

Exploitation of public-facing applications<\/h3>\n

In the incident affecting an Indonesian diplomatic entity, the threat actor exploited Microsoft Exchange vulnerabilities, including CVE-2021-26855 (ProxyLogon), to gain access to the target environment. Similar activity was observed in Taiwan, where software development organizations were compromised through exploitation of Openfire (CVE-2023-32315). In a separate incident affecting a Colombian organization, the threat actor exploited a GeoServer instance vulnerable to CVE-2024-36401.<\/p>\n

Beyond these incidents, we identified additional exploitation activity targeting vulnerabilities in multiple internet-facing enterprise applications and network appliances including those listed below:<\/p>\n

Remote Code Execution (RCE)<\/strong><\/p>\n