A newly discovered malware family is making its way onto systems worldwide by hiding inside fake software installers that look completely legitimate. <\/p>\n
Researchers have identified a campaign where attackers disguise their malicious tools as trusted programs like Cisco AnyConnect and Google Update, tricking users into running them without suspicion. <\/p>\n
Once the file is executed, a custom loader called SharkLoader quietly installs itself in the background.<\/a><\/p>\n The campaign has a wide reach. Victims have been confirmed across Indonesia, Taiwan, Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. <\/p>\n Targets include government agencies, diplomatic bodies, and software development firms, suggesting the attackers have both strategic and opportunistic goals in mind.<\/a><\/p>\n Analysts at\u00a0Securelist\u00a0identified the malware and published a detailed report<\/a> shared with Cyber Security News (CSN), calling the broader campaign \u201cStrikeShark.\u201d <\/p>\n Researchers say SharkLoader is designed to load and execute a well-known hacking tool called Cobalt Strike Beacon onto compromised machines, giving attackers deep remote access and control.<\/p>\n The threat actor behind this campaign exploits a range of vulnerabilities in widely used enterprise software to break into target networks. <\/p>\n These include known flaws in Microsoft Exchange, Microsoft SharePoint, Fortinet FortiOS, and Cisco IOS XE, among others. Researchers assess with medium confidence that the group relies on publicly available exploit code, making the activity largely opportunistic.<\/a><\/p>\n Attribution remains preliminary, as the researchers note that several post-exploitation tools observed in the campaign, including FScan, Searchall, and Pillager, were developed by Chinese-speaking individuals. <\/p>\n However, no confirmed link to any known hacking group has been established<\/a>, and investigators continue to look into the campaign\u2019s full scope.<\/a><\/p>\n One of the most notable delivery methods in this campaign involves fake software installers that look identical to the real thing. <\/p>\n In one analyzed sample, the dropper contained a genuine Cisco AnyConnect VPN<\/a> installer compressed inside it. <\/p>\n When the victim ran the file, the real installer launched and completed normally, creating a convincing illusion that nothing suspicious had happened.<\/a><\/p>\n While that process played out, SharkLoader components were silently written to hidden directories in the background. The dropper also used files named GoogleUpdateStepup.exe and AutoUpdate.exe to appear as routine update utilities. <\/p>\n Some samples additionally dropped decoy PDF documents on the victim\u2019s machine as a distraction while the malware installed itself quietly.<\/a><\/p>\n After dropping its components, the malware created two Windows scheduled tasks to maintain persistence. <\/p>\n The first task ran every five minutes, ensuring the loader stayed active over time. The second fired every second immediately after deployment, then was removed after about 1.5 seconds, likely to guarantee SharkLoader launched right away.<\/a><\/p>\n SharkLoader uses a multi-component structure to avoid detection. It relies on DLL sideloading, where a legitimate Windows application<\/a> called SystemSettings.exe is copied to a new location and used to load a malicious file named SystemSettings.dll. <\/p>\n From there, the loader decrypts and executes additional encrypted modules entirely in memory, never writing the final payload to disk.<\/a><\/p>\n One of those modules, DscCoreR.mui, is decrypted using a Blowfish cipher and contains the Cobalt Strike Beacon shellcode.<\/p>\n Another module, SyncRes.dat, uses AES-128 encryption and installs numerous Windows API hooks designed to bypass security monitoring. These hooks redirect system calls through custom stubs, making the malware far harder to detect.<\/a><\/p>\n The campaign also hooks Windows event logging functions such as EtwEventWrite and EventWrite, forcing them to return empty values and blinding any monitoring tools that rely on system logs. <\/p>\n Researchers observed parent process ID spoofing as well, making malicious child processes appear as if they were launched by the legitimate svchost.exe process.<\/a><\/p>\n After gaining a foothold, attackers ran reconnaissance commands, dumped credentials<\/a> from the LSASS process, and used ntdsutil to extract Active Directory password hashes. <\/p>\n These steps allowed the attacker to move through the network and escalate privileges. Organizations are strongly advised to patch internet-facing applications, monitor scheduled task creation, and deploy endpoint tools capable of detecting in-memory threats.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\n![\"Malicious](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEik1XOzDmNcJNI-Kh_e8M7jT7O8iW3b55iNgAcqRL22XyPz1gMrzeqDnEQsfmqN0IQuihbJr91QcV8SGXqQla9WXcXdtn2YSkXt6Gmv8HQVl5oPJoEvdtKbcYexOEkrdWOzeyvykjtajFNcB_u-OfCBpBJu-_V5O6h-yZEqSwye1o1lXseuEp1KpZf5Ld8\/s16000\/Malicious%2520Cisco%2520Secure%2520Client%2520installer%2520%28Source%2520-%2520Securelist%29.webp?ssl=1\")
Hackers Use Cisco AnyConnect and Google Update Lures<\/strong><\/h2>\n
![\"The](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh4QpZhoOEkwMYL5BjdNzgz4joknHQT_A3TDAPNGT69KI1gk2euCd0SFdo3v1CjNeHG31X9MIryjC8fKmQjh6DW820KvKDZZ0LM808rFMOHlBhawO7u2eVbkgrEiwiGYcOCiquJzeEMlUrKIkKgf19ylcEMh7ZmDG2xnyqVUrppfFQKp7qBE5GOt19syhE\/s16000\/The%2520dropper%2520extracts%2520SystemSettings.dll%2520%28Source%2520-%2520Securelist%29.webp?ssl=1\")
SharkLoader\u2019s Multi-Stage Execution and Evasion Methods<\/strong><\/h2>\n
![\"SharkLoader](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjx7zZv8dYsQBMrA5WrxofxY9wlGVlmyUJE-th8MMNYLP3xZxSqzegiagXNzQ-z_xNSH-7XlyTCaxaocEGj36rjuSrKU0ExpYBSV6an6ytHeY5kGAj8o4j1F8AlaCHTlZM5IgeiQfg2IJfQnVSDrBJqgnFjm0B26nzLB2CelgfQppP6twrH95FtytT4OiY\/s16000\/SharkLoader%2520infection%2520chain%2520%28Source%2520-%2520Securelist%29.webp?ssl=1\")