New Shark Loader Malware Deploys Cobalt Strike in Strike Shark Cyberattacks
Summary: Kaspersky is tracking a campaign it calls StrikeShark that delivers a previously undocumented loader, SharkLoader, which deploys Cobalt Strike Beacon on compromised hosts, targeting a diplomatic organization in Indonesia, government organizations in Taiwan, software development companies across multiple countries, and entities in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. Initial access came through exploitation of known flaws including ProxyLogon (CVE-2021-26855) against the Indonesian diplomatic entity, an Openfire path traversal (CVE-2023-32315) against Taiwanese software development organizations, and a GeoServer remote code execution bug (CVE-2024-36401) against a Colombian organization, with persistence established via web shells and a DLL side-loading chain involving SystemSettings.exe (CVE-2021-27076).
Bottom line: Kaspersky assesses the operators are likely Chinese-speaking and used publicly available proof-of-concept exploits opportunistically, and with no data exfiltration observed yet, Cobalt Strike's file operation and exfiltration modules could still be deployed later.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26855CVE-2021-27076CVE-2023-32315CVE-2024-36401
- Related
- CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability Known Exploited Vulnerabilities · Jul 15, 2024CVE-2023-32315: Ignite Realtime Openfire Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 24, 2023CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021