SharkLoader / StrikeShark — Multi-Stage Cobalt Strike Loader

SharkLoader is a previously undocumented, multi-stage loader whose only job is to stand up a Cobalt Strike Beacon on a compromised host. Kaspersky tracks the campaign as StrikeShark and assesses the operator as a Chinese-speaking actor with low confidence (no code/infra overlap with known groups). Targeting is broad — a diplomatic organization in Indonesia, government bodies in Taiwan, and software-development firms plus other entities across Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia — consistent with espionage/information-gathering.

Initial access is primarily exploitation of internet-facing applications (ProxyLogon Exchange, SharePoint, Openfire, GeoServer, F5 BIG-IP, FortiOS, Zimbra, Apache Shiro) dropping a webshell, plus malicious droppers masquerading as installers (GoogleUpdateStepup.exe, AnyConnect…predeploy, AutoUpdate.exe). The loader uses DLL side-loading — a legitimate SystemSettings.exe loads a malicious SystemSettings.dll — then "perfect DLL hijacking" against loader internals, Blowfish/AES decryption of staged modules (DscCoreR.mui, SyncRes.dat), reflective in-memory PE loading, Microsoft Detours/MinHook API hooking (PPID spoofing to svchost.exe, ETW patching, direct NT syscall stubs), and a zlib-compressed Beacon executed in memory.

Persistence is multi-pronged: COM-created scheduled tasks masquerading as OneDrive Standalone Update Task / MicrosoftUpdateTask… / Edgeupdate, and a CurrentVersion\Run value named MFUpdate pointing at a copied SystemSettings.exe. Hands-on-keyboard follows: AD/privileged-group enumeration and credential theft via procdump on LSASS and ntdsutil "ifm".

Defender priority: The cleanest catches are SystemSettings.exe running anywhere other than System32\ImmersiveControlPanel (side-load tell), web-server processes (w3wp/java/tomcat) spawning shells/recon (T1190), the MFUpdate Run-key and masqueraded SYSTEM scheduled tasks, and the LSASS/NTDS dumping commands. Virtual-patch the exposed edge apps first — that closes the front door the whole chain depends on.

Atomic IOCs below (MD5 hashes, four C2 domains) are from the Securelist indicator set. The exploited CVEs are the actor's known entry vectors — confirm patch state on any matching internet-facing service. Behavioral tells (SystemSettings side-load, scheduled-task masquerade, MFUpdate Run-key) are the durable detections; hashes/domains will rotate.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): SystemSettings.exe is running from a path other than ...\ImmersiveControlPanel\ → DLL side-load. T1574.002.
2. H2 (high): A web-server / app process (w3wp, java, tomcat, openfire) spawned a shell or recon binary → public-facing-app exploitation. T1190.
3. H3 (high): A CurrentVersion\Run value named MFUpdate exists → StrikeShark persistence. T1547.001.
4. H4 (high): A file matching a Securelist hash executed/was written. Atomic.
5. H5 (high): A host resolved a known StrikeShark C2 domain. T1071.001.
6. H6 (medium): A SYSTEM scheduled task was created masquerading as Edge/OneDrive/Update and runs SystemSettings.exe. T1053.005 + T1036.004.
7. H7 (medium): LSASS or NTDS credential theft via procdump/comsvcs/ntdsutil ifm. T1003.
8. H8 (medium): Privileged-group / AD enumeration burst. T1087.002 + T1069.002.
9. H9 (medium): SharkLoader encrypted-module artifacts (DscCoreR.mui, SyncRes.dat) written to disk. T1027.

Attack chain

All values published by Kaspersky/Securelist. Hashes are MD5 as published; C2 domains rotate — treat as perishable. Behavioral tells are the durable layer.

• Edge-app patch state: Inventory internet-facing Exchange/SharePoint/Openfire/GeoServer/F5/FortiOS/Zimbra/Shiro for the CVEs in §1; any unpatched, internet-exposed instance is an open door. (Playbook P1.)
• IIS / web logs: Hunt for webshell access patterns and POSTs to anomalous .aspx/.jsp under wwwroot/custerr; correlate with w3wp.exe spawning cmd.
• Windows Security 4698 (task created): Review scheduled tasks named like Edge/OneDrive/MicrosoftUpdate that execute a binary outside System32.
• Windows Security 4688 / Sysmon 1: SystemSettings.exe with a parent that is not the shell, or running from ProgramData/AppData.
• DC event 4662 / NTDS: Watch for ntdsutil "ifm" outside sanctioned backup windows.
• Proxy/NGFW: Beacon callbacks to the four C2 domains and look-alike ms-* / connect-microsoft domains.

Promotion path: Q1 and Q9 are low-FP and structural — validate over 7–14 days, then promote to detect, escalate Q1 to block. Q4 hashes → Custom IOC Management (block). Q2/Q6/Q7 stay investigate-led until tuned against your baseline.

One-click blocks for SOC tooling. Hashes (MD5) and C2 domains are Securelist-published; swap expirations to fit your policy.

type,value,action,severity,expiration,description,tags
md5,9c872a0d5d5a38950e8b9ac9b488be3f,prevent,critical,2026-12-29,SharkLoader DLL,campaign:StrikeShark
md5,aa3086be652c8b20b0b29b2730d57119,prevent,critical,2026-12-29,SharkLoader DLL,campaign:StrikeShark
md5,c559cc68986933200fd5d9e4388e2f58,prevent,high,2026-12-29,StrikeShark installer,campaign:StrikeShark
md5,b3352b42432dedc4a519f011dc8b5d5a,prevent,high,2026-12-29,StrikeShark dropper,campaign:StrikeShark
md5,24fcebdeecba65004fdb0923763d74fd,prevent,high,2026-12-29,StrikeShark dropper,campaign:StrikeShark
md5,1f65544978b8ea0e745e573b8ee9684b,prevent,high,2026-12-29,StrikeShark dropper,campaign:StrikeShark
domain,connect-microsoft.com,detect,high,2026-09-29,StrikeShark Beacon C2,campaign:StrikeShark
domain,ms-record.com,detect,high,2026-09-29,StrikeShark Beacon C2,campaign:StrikeShark
domain,ms-record.top,detect,high,2026-09-29,StrikeShark Beacon C2,campaign:StrikeShark
domain,ms-tray.top,detect,high,2026-09-29,StrikeShark Beacon C2,campaign:StrikeShark

[ SharkLoader / StrikeShark behaviors ]
- SystemSettings.exe running outside ...\ImmersiveControlPanel\
- SystemSettings.dll side-loaded next to a copied SystemSettings.exe
- w3wp/java/tomcat/openfire spawning cmd/powershell/recon (T1190)
- CurrentVersion\Run value named "MFUpdate"
- schtasks /create: Edgeupdate / OneDrive Standalone Update /
  MicrosoftUpdateTaskUser... running SystemSettings.exe as SYSTEM
- Encrypted modules on disk: DscCoreR.mui, SyncRes.dat,
  GameInputInboxs32.mui
- procdump -ma lsass / ntdsutil "ac i ntds" "ifm"
- Beacon: ETW patched (EtwEventWrite stub), PPID spoof to svchost

Campaign: StrikeShark (Kaspersky)
Actor:    Chinese-speaking (LOW confidence; no known overlap)
Loader:   SharkLoader (DLL side-load via SystemSettings.exe)
Payload:  Cobalt Strike Beacon (zlib shellcode, reflective PE)
Modules:  DscCoreR.mui (Beacon+MinHook), SyncRes.dat (API hooks)
Evasion:  Microsoft Detours + MinHook, ETW patch, NT syscall stubs,
          PPID spoof -> svchost.exe
Droppers: GoogleUpdateStepup.exe, AnyConnect...predeploy, AutoUpdate.exe

[ ] Exchange patched (CVE-2021-26855 ProxyLogon) & not EOL
[ ] SharePoint patched (CVE-2021-27076)
[ ] Openfire >= 4.7.5 (CVE-2023-32315)
[ ] GeoServer patched (CVE-2024-36401)
[ ] F5 BIG-IP patched (CVE-2023-46747)
[ ] FortiOS patched (CVE-2024-21762, CVE-2022-40684)
[ ] Zimbra patched (CVE-2022-27925); Shiro patched (CVE-2016-4437)
[ ] LSASS RunAsPPL / Credential Guard enabled
[ ] ASR "Block credential stealing from lsass.exe" enforced
[ ] Egress: block/alert C2 domains + look-alike ms-* / connect-microsoft

• Telemetry ready: Confirm ProcessRollup2, AsepValueUpdate/RegGenericValueUpdate, DnsRequest, and FileCreateInfo/PeFileWritten flow from servers (incl. internet-facing) and DCs.
• Benign baseline: Run Q2 (web-server children), Q6 (cred dump), and Q7 (AD recon) over 7–14 days; record sanctioned admin/backup/monitoring activity for exclusions before alerting.
• Positive test: In a lab, copy SystemSettings.exe to C:\ProgramData and run it — confirm Q1 fires; add an MFUpdate Run value — confirm Q9 fires.
• Promotion: Promote Q1/Q9 to detect (Q1 → block) only after a clean baseline. Hashes (Q4) → IOC Management block immediately.

P1 · Enable LSASS protection (RunAsPPL)

# Requires reboot. Validate on a pilot ring first.
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' `
  -Name 'RunAsPPL' -Value 1 -PropertyType DWord -Force
# Verify after reboot (expect event 12 in System log, WPP / LSASS protected):
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL

P2 · ASR — block credential stealing from LSASS (enforce)

Add-MpPreference -AttackSurfaceReductionRules_Ids `
  9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Enabled
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

P3 · Audit MFUpdate Run-key and masqueraded tasks fleet-wide

# Run-key check
$rk = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
if (Test-Path $rk) {
  (Get-ItemProperty $rk).PSObject.Properties |
    Where-Object { $_.Name -eq 'MFUpdate' -or $_.Value -match 'SystemSettings\.exe' } |
    Select-Object Name, Value
}
# Suspicious tasks running SystemSettings.exe outside System32
Get-ScheduledTask | ForEach-Object {
  $act = $_.Actions.Execute -join ';'
  if ($act -match 'SystemSettings\.exe' -and $act -notmatch 'System32') {
    [pscustomobject]@{ Task=$_.TaskName; Path=$_.TaskPath; Exec=$act }
  }
}

P4 · AppLocker — constrain SystemSettings.exe location

# Concept rule (deploy via GPO, pilot in Audit first):
# ALLOW SystemSettings.exe ONLY from %SYSTEM32%\ImmersiveControlPanel\
# DENY  SystemSettings.exe from any other path
# Review AppLocker 8003/8004 events for 14 days before switching to Enforce.

Coverage is strongest at the side-load, staging, persistence, and atomic-hash layers (low-FP, structural). Post-exploitation recon/cred-theft need environment tuning. The in-memory Beacon (reflective PE, ETW patch, PPID spoof) and non-Windows edge appliances are genuine gaps — defended by catching the side-load/persistence upstream, EDR memory detections, and patching/segmenting the edge.