StrikeShark Campaign Weaponizes New SharkLoader Malware to Deploy Cobalt Strike Against Asian Government Targets

Introduction

A previously undocumented malware family called SharkLoader has been spotted in the wild, acting as a delivery mechanism for the infamous Cobalt Strike Beacon — a tool of choice for advanced persistent threat groups — in a campaign targeting diplomatic and government entities across Asia.

The problem

Kaspersky researchers have identified a cyber attack campaign they track under the name StrikeShark, which leverages a novel loader named SharkLoader to deploy Cobalt Strike Beacon onto compromised systems. According to reporting by The Hacker News, the campaign has specifically targeted a diplomatic organization in Indonesia and government agencies in Taiwan. This represents a concerning evolution in the attack chain, as threat actors now possess a custom, previously unseen loader to bypass initial detection before delivering a well-known post-exploitation framework.

Consequences

The targeting of diplomatic missions and government bodies in two distinct sovereign states signals that the operators behind StrikeShark are likely state-sponsored or highly resourced espionage groups. A successful compromise could lead to the exfiltration of sensitive diplomatic communications, classified policy documents, or intelligence data. For the victims, the discovery of a custom loader like SharkLoader means that standard signature-based antivirus and endpoint detection tools may initially miss the first stage of the intrusion, giving attackers an extended dwell time to establish persistence and move laterally.

Causes