StrikeShark SharkLoader Threat that combines initial access with memory load to evade detections

The emergence of SharkLoader, a loader (loader) so far unknown that Cobalt Strike Beacon delivers into committed teams, confirms a trend: attackers are combining proven initial access tools with advanced memory evasion techniques to maintain a sharp presence within government and private sector networks. Kaspersky, who calls the StrikeShark campaign, has documented commitments in diplomacy, state agencies and software development companies in multiple regions, suggesting a comprehensive and opportunistic approach rather than a single-sector campaign.

The intrusion is based on classic but effective vectors: public exploits against exposed applications (including Exchange, Openfire and GeoServer, among other exploited CVE) and the use of malicious installers or droppers that pass through legitimate software. This combination of exploitation of known failures and convincing lures (decoand PDFs, false installers) facilitates initial access without the need for zero-day tools, making the management of vulnerability inventory and timely parking critical.

One of the most troubling technical identity signs of this campaign is the loading technique used by Symantec: a variant of DLL hijacking described as "Perfect DLL Hijacking," designed to avoid Windows charger blockages and run code in memory. From there Cobalt Strike Beacon is deployed through a chain that includes the DscCoreR.mui load and the installation of API hooks with libraries such as Microsoft Detours and MinHook to copy and activate the shellcode in memory. The aim is to avoid detections based on executable memory regions and to persist in the system long enough for recognition and climbing.

After obtaining persistence - with external mechanisms to the loader as Run keys in the Register or programmed tasks that relaunch SystemSettings.exe - operators perform an extensive phase of recognition: listing Active Directory, stealing credentials from LSASS and the NTDS file, and using open-source tools for scanning and collecting information. Although no evidence of mass data exfiltration has been observed so far, the use of Cobalt Strike and the selection of victims indicates a clear potential for cyberespionage and intellectual property theft, as well as the possibility of exfiltration coming later.

The implications for organizations are clear: the public availability of PoC on platforms such as GitHub allows opportunistic attackers to quickly exploit known failures, and memory loading techniques make retroactive detection more difficult. In addition, the installation supplanting legitimizes the initial engagement path and complicates prevention based only on filtering of attachments or mail blocks.

In order to reduce the immediate risk, it is essential to prioritize the patching of applications exposed to the outside and to audit the remote access vectors. The configuration of Exchange servers, messaging services and management portals should be reviewed and strengthened, as well as the identification and cleaning of possible web shells used by attackers to persist and launch load chains. Detection tools should focus on critical process anomalies (e.g. unusual SystemSettings.exe executions that load unsigned DLs), scheduled job modifications and Run keys, and Cobalt Strike Beacon's own network behaviors.

Defenses must also incorporate memory detection and process integrity controls to identify executable memory techniques and API hooks, complemented by Active Directory monitoring and alerts on NTDS service access or reading and LSASS process. The rotation of credentials, the segmentation of networks, the removal of accounts with unnecessary privileges and the activation of multifactor authentication are measures that reduce the effectiveness of lateral movements after intrusion.

From the intelligence and response perspective, it is useful to correlate indicators with public and private sources and to maintain a proactive hunting position: review historical log to detect anomalous access to exposed services, check integrity of binary and system libraries, and be prepared for containment actions if Cobalt Strike is detected on the network. The community can find general and contextual references to Cobalt Strike and related techniques in knowledge bases such as MITRE ATT & CK - Cobalt Strike Beacon and information on vulnerabilities exploited in public services can be found in repositories and advisories of manufacturers and response centres such as Sequrelist (Kaspersky).

In short, StrikeShark and SharkLoader are a reminder that the attack surface is not only technological but operational: the speed of patching, the hygiene of credentials, the visibility in memory and processes, and the coordinated response capacity determine whether an initial access becomes a persistent and costly intrusion. Organizations with exposed assets should now act: the audit of exposed ends, the deployment of memory detection, the cleaning of possible web shells and the preparation of stage-oriented containment playbooks where Cobalt Strike is already present.