New SharkLoader Malware Used to Deploy Cobalt Strike in Global Cyberattacks

Introduction of SharkLoader Malware

A recently identified cyber campaign employs a new malware strain named SharkLoader. This malware acts as a loader to deploy Cobalt Strike Beacon on compromised systems, indicating an escalation in effective cyber-attack methodologies.

Targeted Organizations and Geographic Reach

Kaspersky identifies the campaign's targets as diverse, including a diplomatic entity in Indonesia and multiple governmental and software development organizations in Taiwan. Other affected countries include Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia, highlighting the campaign's extensive geographical reach.

Exploitation Methods

The operators have exploited several known vulnerabilities, including Exchange Server flaws (CVE-2021-26855) and a path traversal vulnerability in Openfire (CVE-2023-32315). Additionally, a wide range of other vulnerabilities across various platforms have been weaponized to gain access to the systems and deliver the SharkLoader malware.

Potential Threat Actor

While no direct links to known threat actors or groups have been established, the use of open-source tools like FScan and Pillager suggests that Chinese-speaking developers may be behind the campaign. This adds to the suspicion regarding the operators' origins and intentions.

Conclusion

The emergence of SharkLoader and its deployment methods represent a high-level threat, utilizing effective exploitation techniques and targeting a wide array of sectors. Organizations should be aware of the vulnerabilities being exploited and strengthen their defenses against such opportunistic attack campaigns.