Malwarehigh
StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-4437 | Unauthenticated RCE via hard-coded cipher key in Apache Shiro 'remember me' | 9.8 | 93% | KEVPoC | KEV |
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2021-27076 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 | 14% | ||
| CVE-2021-36260 | Unauthenticated Command Injection in Hikvision Device Web Server | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2022-27925 | Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite | 7.2 | 99% | KEVRansomwarePoC | KEV |
| CVE-2022-40684 | Admin-Interface Auth Bypass in Fortinet FortiOS, FortiProxy & FortiSwitchManager | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-41082 | Authenticated RCE in Microsoft Exchange Server (ProxyNotShell) | 8.0 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) | 10.0 | 100% | KEV | KEV |
| CVE-2023-32315 | Unauthenticated Path Traversal in Ignite Realtime Openfire Admin Console | 7.5 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-46747 | F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE | 9.8 | 97% | KEVRansomwarePoC ×2 | KEV |
| CVE-2024-21762 | Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy | 9.8 | 85% | KEVRansomware | KEV |
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1f65544978b8ea0e745e573b8ee9684b | er sample, discovered on a machine located in Lebanon (MD5: 1F65544978B8EA0E745E573B8EE9684B), the dropper extracts and decompresses SystemSettings.dll |
| md5 | 24fcebdeecba65004fdb0923763d74fd | licious dropper named 一种异常状况的截图（包括操作系统和输入法版本）.pdf.exe (MD5: 24FCEBDEECBA65004FDB0923763D74FD), which was identified in a campaign targeting a government |
| md5 | 9cbd560f820c95d7c38342cd558cb5c6 | DscCoreR.mui A514D1BB62D7916475946FE7C07AC0AA SyncRest.dat 9CBD560F820C95D7C38342CD558CB5C6 “PerfectDLL Hijacking” technique Once the malicious DLL is |
| md5 | a514d1bb62d7916475946fe7c07ac0aa | mSettings.dll AA3086BE652C8B20B0B29B2730D57119 DscCoreR.mui A514D1BB62D7916475946FE7C07AC0AA SyncRest.dat 9CBD560F820C95D7C38342CD558CB5C6 “PerfectDLL H |
| md5 | aa3086be652c8b20b0b29b2730d57119 | ngs.exe D98F568496512E4F98670C61C97CB07A SystemSettings.dll AA3086BE652C8B20B0B29B2730D57119 DscCoreR.mui A514D1BB62D7916475946FE7C07AC0AA SyncRest.dat |
| md5 | d98f568496512e4f98670c61c97cb07a | overnment entity in Taiwan. Filename MD5 SystemSettings.exe D98F568496512E4F98670C61C97CB07A SystemSettings.dll AA3086BE652C8B20B0B29B2730D57119 DscCore |
From the original article
12 min read at securelist.com
During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader . What initially appeared to be an isolated case quickly expanded into a broader campaign as we identified additional SharkLoader infections across multiple countries and sectors.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.