SharkLoader Uses Public Exploits and Fake Installers to Target Governments

Why it matters

StrikeShark shows how one loader can bridge two attack modes: opportunistic exploitation of exposed services and lure-based delivery through fake installers. The campaign touched diplomatic and government networks across multiple regions, and it used Cobalt Strike Beacon as the final payload. That combination raises the risk for any internet-facing organization that has not fully inventoried exposed apps or audited sideloading behavior.

What happened

Kaspersky’s 24 June analysis described SharkLoader infections in Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, Serbia, and more. CyberPress followed on 25 June with a shorter summary that highlighted the government-targeting angle and repeated the IOC set, including the domain connect-microsoft[.]com and several MD5 hashes. Both reports agree on the core pattern: public PoCs or fake installers open the door, and SharkLoader then stages a Cobalt Strike implant.

Technical details

SharkLoader is built to stay quiet. In the exploitation path, attackers leverage public-facing apps such as Exchange, Openfire, and GeoServer, drop webshells, and then side-load SystemSettings.dll from a copied SystemSettings.exe. The loader manipulates the Windows loader lock, decrypts DscCoreR.mui with Blowfish, decrypts SyncRes.dat with AES, installs API hooks, suppresses ETW, and eventually resumes a suspended thread that runs beacon shellcode. In the lure path, droppers masquerade as Cisco AnyConnect, Google Update, or benign PDFs. The practical IOCs to hunt are the domains connect-microsoft[.]com, ms-record[.]com, ms-record[.]top, and ms-tray[.]top, plus the loader and dropper hashes in the article metadata.

Defender actions

Prioritize patching or isolating exposed Exchange, Openfire, GeoServer, SharePoint, FortiOS, and Cisco IOS XE systems. Hunt for unexpected SystemSettings.exe execution, new scheduled tasks, suspicious Run keys, and DLL sideloading from writable directories such as %APPDATA% or ProgramData. Block the listed domains and hashes, then review DNS, proxy, and EDR telemetry for the process trees that load Cobalt Strike. If you confirm a foothold, reset privileged credentials and reimage affected hosts instead of trying to clean them in place.