Researchers at Kaspersky have uncovered a new cyber attack campaign dubbed StrikeShark that employs a previously undocumented malware family known as SharkLoader. The loader is used to deliver Cobalt Strike Beacon onto compromised systems, marking a notable evolution in initial access tactics.
The campaign has targeted a diplomatic organization in Indonesia and government entities in Taiwan, according to Kaspersky. While the full scope of affected systems remains unclear, the focus on high-value geopolitical targets suggests a sophisticated threat actor with strategic objectives.
SharkLoader acts as a first-stage dropper, likely distributed via phishing emails or malicious downloads. Once executed, it establishes persistence and downloads Cobalt Strike Beacon, a commercial penetration testing tool widely abused by attackers for command-and-control and lateral movement. The exact exploit mechanism and indicators of compromise have not been publicly detailed.
Kaspersky has not yet released specific mitigation guidance or indicators of compromise. Organizations in the diplomatic and government sectors, particularly in Southeast Asia, are advised to monitor for suspicious network activity, restrict use of Cobalt Strike in non-authorized environments, and implement robust email filtering.
Attribution for the StrikeShark campaign remains unknown. Kaspersky did not link the activity to any known threat group, though the targeting of diplomatic and government entities aligns with state-sponsored espionage operations. The use of custom loaders like SharkLoader underscores the continued innovation in malware delivery chains.