<p><img alt="" class="respon-img" src="/preview/f/blog/914525/919292/0p0/c9e5c5a1-5a82-46ee-9ae7-7cf19e60bebb.png" /><img alt="" class="respon-img" src="/preview/f/blog/914480/919264/700p467/sharkloader-attack-chain.png" style="height:467px; width:700px" /></p> <p style="text-align: center;">(Image generated by generative AI and reviewed under professional human supervision.)</p> <p> </p> <p>A recently observed campaign, tracked as <strong>StrikeShark</strong>, highlights how attackers continue to exploit unpatched internet-facing systems to gain initial access into enterprise networks. The campaign leverages a multi-stage malware loader, referred to as <strong>SharkLoader</strong>, to deploy <strong>Cobalt Strike</strong> malware, a widely used post-exploitation framework.</p> <p> </p> <p>Although the malware components in this campaign demonstrate moderate technical sophistication, the most critical takeaway for organisations is that initial compromise is heavily dependent on known and<strong> publicly exploitable vulnerabilities</strong>. This reinforces the importance of timely patching and exposure management.</p> <p> </p> <p> </p> <h2>Exploitation of Public-Facing Applications</h2> <p>The StrikeShark campaign primarily gains initial access by exploiting vulnerabilities in <strong>internet-facing enterprise applications</strong>. These systems are often directly reachable from the internet and therefore present a high-risk attack surface if not properly secured.</p> <p> </p> <p>Observed attacks have targeted a range of widely deployed platforms, including:</p> <ul> <li><strong>Microsoft Exchange Server</strong> (e.g. CVE-2021-26855, ProxyLogon)</li> <li><strong>Microsoft SharePoint</strong> (e.g. CVE-2021-27076)</li> <li><strong>Openfire Server</strong> (e.g. CVE-2023-32315)</li> <li><strong>GeoServer</strong> (e.g. CVE-2024-36401)</li> </ul> <p> </p> <p>In addition, threat actors were observed scanning and exploiting vulnerabilities in various enterprise software and network appliances, including:</p> <ul> <li><strong>Apache Shiro</strong> – CVE-2016-4437</li> <li><strong>Hikvision products</strong> – CVE-2021-36260</li> <li><strong>Zimbra Collaboration Suite</strong> – CVE-2022-27925</li> <li><strong>Microsoft Exchange Server</strong> – CVE-2022-41082</li> <li><strong>F5 BIG-IP</strong> – CVE-2023-46747</li> <li><strong>Fortinet FortiOS</strong> – CVE-2022-40684, CVE-2024-21762</li> <li><strong>Cisco IOS XE Web UI</strong> – CVE-2023-20198</li> <li><strong>Jenkins</strong> – CVE-2024-23897</li> <li><strong>Joomla CMS</strong> – CVE-2023-23752</li> <li><strong>React Server Components</strong> – CVE-2025-55182</li> </ul> <p> </p> <p>Many of these vulnerabilities are classified as <strong>remote code execution</strong> or <strong>authentication bypass</strong> issues, allowing attackers to execute arbitrary commands on vulnerable systems without valid credentials.</p> <p> </p> <p>Notably, exploit code for these vulnerabilities is widely available on public platforms, meaning attackers do not need to develop custom exploits. This suggests that the campaign is, at least in part, opportunistic, targeting organisations that have not applied security updates.</p> <p> </p> <p> </p> <h2>Why These Vulnerabilities Are Critical</h2> <p>Vulnerabilities affecting internet-facing services are particularly dangerous because they can be exploited remotely with minimal interaction. In many cases, attackers can:</p> <ul> <li>Gain direct access to servers exposed to the internet</li> <li>Deploy webshells for persistent remote control</li> <li>Use compromised servers as footholds for deeper network intrusion</li> </ul> <p> </p> <p>Once initial access is established, attackers can quickly move to the next stages of the attack lifecycle, including credential theft and lateral movement.</p> <p> </p> <p> </p> <h2>From Initial Access to Malware Execution</h2> <p>After successfully exploiting a vulnerability, attackers deploy <strong>SharkLoader</strong> using techniques such as webshell-based command execution or malicious droppers.</p> <p> </p> <p>A commonly observed method involves abusing legitimate Windows applications for DLL side-loading. For example, attackers copy a legitimate binary such as <strong>SystemSettings.exe</strong> to a writable directory and execute it alongside a malicious DLL, allowing the malicious code to run while appearing legitimate.</p> <p> </p> <p>The loader then decrypts and executes additional payloads directly in memory, ultimately launching a <strong>Cobalt Strike Beacon</strong>, which enables remote command execution and further compromise.</p> <p> </p> <p> </p> <h2>Post-Compromise Activity</h2> <p>Following initial access, attackers typically perform:</p> <ul> <li>System and network reconnaissance</li> <li>Active Directory enumeration</li> <li>Credential harvesting (e.g. LSASS dumping)</li> <li>Lateral movement across the network</li> </ul> <p> </p> <p>The use of <strong>Cobalt Strike</strong> significantly enhances the attackers’ ability to conduct these operations while maintaining stealth.</p> <p> </p> <p> </p> <h2>Impact</h2> <p>The targeting of government entities and software-related organisations suggests a potential focus on <strong>information gathering and long-term access</strong>. However, the reliance on widely known vulnerabilities also indicates that any organisation with exposed and unpatched systems may be at risk.</p> <p> </p> <p>This highlights that even advanced attack chains often begin with basic security gaps, such as missing patches or exposed services.</p> <p> </p> <p> </p> <h2>Security Recommendations</h2> <ol> <li><strong>Prioritise patching of internet-facing systems</strong></li> </ol> <p>Organisations should urgently review and patch all publicly exposed systems, particularly those affected by the CVEs listed above.</p> <p> </p> <ol> <li><strong>Reduce internet exposure of critical services</strong></li> </ol> <p>Where possible, restrict access to administrative interfaces and enterprise services using VPN, IP allowlists, or zero-trust access models.</p> <p> </p> <ol> <li><strong>Monitor exploitation and scanning attempts</strong></li> </ol> <p>Implement monitoring and alerting for suspicious requests targeting known vulnerable endpoints, as well as scanning activity against exposed services.</p> <p> </p> <ol> <li><strong>Detect webshell and abnormal command execution</strong></li> </ol> <p>Monitor for unusual command execution patterns, especially originating from web servers or application processes.</p> <p> </p> <ol> <li><strong>Identify suspicious use of legitimate binaries</strong></li> </ol> <p>Pay attention to abnormal execution of system binaries such as <strong>SystemSettings.exe</strong> from non-standard locations.</p> <p> </p> <ol> <li><strong>Strengthen credential protection</strong></li> </ol> <p>Implement controls such as MFA, least privilege access, and protections for credential storage to mitigate post-compromise risks.</p> <p> </p> <p> </p> <h2>Conclusion</h2> <p>The StrikeShark campaign demonstrates that attackers continue to rely heavily on <strong>known vulnerabilities</strong> in exposed systems as an entry point. While the malware itself employs advanced techniques such as in-memory execution and API manipulation, the success of the attack often depends on unpatched or misconfigured services.</p> <p> </p> <p>Organisations should treat vulnerability management and exposure reduction as critical components of their security strategy, as these measures can effectively disrupt the attack chain at its very first stage.</p> <p> </p> <p> </p> <h2>Reference Link</h2> <ul> <li><a href="https://securelist.com/strikeshark-campaign/120326/" target="_blank">https://securelist.com/strikeshark-campaign/120326/</a></li> </ul>