Malwarecritical

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

The Hacker Newsby @TheHackersNewsJun 27, 2026 · 12:06 UTC (Jun 27, 2026)4 min read5 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-26855 CVE-2023-32315 CVE-2024-36401 CVE-2016-4437 CVE-2021-36260 CVE-2021-27076 CVE-2022-27925 CVE-2022-41082 CVE-2023-46747 CVE-2024-21762 CVE-2025-55182 CVE-2022-40684 CVE-2023-20198

Tags: cve-2016-4437 cve-2021-26855 cve-2021-36260 cve-2023-32315 cve-2024-36401 malware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2016-4437	Unauthenticated RCE via hard-coded cipher key in Apache Shiro 'remember me'	9.8	93%	KEVPoC	Jun 7, 2016 KEV Nov 3, 2021
CVE-2021-26855	Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)	9.1	100%	KEVRansomwarePoC ×4	Mar 3, 2021 KEV Nov 3, 2021
CVE-2021-27076	Microsoft SharePoint Server Remote Code Execution Vulnerability	8.8	14%		Mar 11, 2021
CVE-2021-36260	Unauthenticated Command Injection in Hikvision Device Web Server	9.8	100%	KEVPoC ×3	Sep 22, 2021 KEV Jan 10, 2022
CVE-2022-27925	Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite	7.2	99%	KEVRansomwarePoC	Apr 21, 2022 KEV Aug 11, 2022
CVE-2022-40684	Admin-Interface Auth Bypass in Fortinet FortiOS, FortiProxy & FortiSwitchManager	9.8	100%	KEVRansomwarePoC ×2	Oct 18, 2022 KEV Oct 11, 2022
CVE-2022-41082	Authenticated RCE in Microsoft Exchange Server (ProxyNotShell)	8.0	100%	KEVRansomwarePoC	Oct 3, 2022 KEV Sep 30, 2022
CVE-2023-20198	Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited)	10.0	100%	KEV	Oct 16, 2023 KEV Oct 16, 2023
CVE-2023-32315	Unauthenticated Path Traversal in Ignite Realtime Openfire Admin Console	7.5	100%	KEVPoC ×2	May 26, 2023 KEV Aug 24, 2023
CVE-2023-46747	F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE	9.8	97%	KEVRansomwarePoC ×2	Oct 26, 2023 KEV Oct 31, 2023
CVE-2024-21762	Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy	9.8	85%	KEVRansomware	Feb 9, 2024 KEV Feb 9, 2024
CVE-2024-36401	Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection	9.8	100%	KEVPoC ×3	Jul 1, 2024 KEV Jul 15, 2024
CVE-2025-55182	Unauthenticated RCE in React Server Components (React2Shell)	10.0	100%	KEVRansomwarePoC ×13	Dec 3, 2025 KEV Dec 5, 2025

From the original article

4 min read at thehackernews.com

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.