SharkLoader Malware Uses Fake Cisco AnyConnect, Google Updates

Key Takeaways

• A new malware loader, dubbed SharkLoader, has been identified actively infiltrating networks disguised as legitimate software updates.
• The malware delivers Cobalt Strike Beacon, a powerful post-exploitation framework, enabling extensive lateral movement and data exfiltration.
• Attackers leverage both known vulnerabilities in enterprise software (Microsoft Exchange, Fortinet, Cisco IOS XE) and social engineering tactics using fake installers for Cisco AnyConnect and Google Update.
• SharkLoader employs sophisticated evasion techniques, including DLL side-loading, in-memory execution, and API hooking, to bypass detection.
• Victims include government, diplomatic, and software entities across multiple countries, indicating a broad and potentially intelligence-gathering motivated campaign.

Cybersecurity researchers have uncovered a new and highly evasive malware loader, christened SharkLoader, which is covertly compromising systems by masquerading as trusted software installers. This sophisticated tool has been observed deploying Cobalt Strike Beacon, a widely recognized post-exploitation framework, onto infected machines.

The ongoing campaign, attributed to an attacker cluster dubbed StrikeShark, combines classic social engineering with advanced technical stealth. Attackers exploit familiar user habits, presenting malicious payloads as routine updates for legitimate applications, while the malware itself employs intricate evasion mechanisms to remain undetected.

Dual-Pronged Attack Strategy

StrikeShark operators are not relying on a singular method for initial access. Their strategy involves a two-pronged approach. Firstly, they actively exploit known vulnerabilities in critical enterprise software, including Microsoft Exchange, SharePoint, Fortinet appliances, and <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/a2df4c80-4ef5-4335-a0cf-63ca118dd720/Hackers-Use-Fake-Cisco-AnyConnect-and-Google-Update-Installers-to-Drop-SharkLoader.pdf?AWSAccessKeyId=ASIA2F3EMEYEZRO333NI&Signature=C7TvBw6HoZ%2FTbuYfp6ja2TJuSg8%3D&x-amz-security-token=IQoJb3JpZ2luX2VjED8aCXVzLWVhc3QtMSJGMEQCIBed6wY9I2u29UhPhIsPY497zmbjU4QdI7T1iF46LKbAAiAU%2B0xWTa2rl2SpGwUBweUYf%2FDwu5xPNETuJOCnfN%2BsTyrzBAgIEAEaDDY5OTc1MzMwOTcwNSIMMNllOEflHnvPI5SDKtAEJF7Bf68GEa09ILyobxVU0vXh%2B4QJIVc%2BelienwYnLf%2BkP1BRxuhvd91a%2Bu%2FDngGveC2eaAKSz63ILREneeb3Ygx76BwkvAdfsdjczzSrubdlpnO6UX9PtDk0AaIdHsrP%2F9JVAS3kcQ9AcI4Ywlf9VPPrKa7J%2Fe%2BrLmcQsDOfE%2B3P4MlZZo7rO0AXqmkKvmMBoKLYyCN7bgaG5%2BmcFxej7rSu9Rc4UqaSGGnm88i2zFs3WHbz5vMPwchZtxoetjjdPCBgfHRsP%2FNAkFAKfSSlmOjsS0pP133%2B3gB2BnLwCZkBebYueIBr033eklQbwCfKHWCoJrPTNWI9ZKhnOYG0xPPxTcQy%2FczG8qNCootHHJFoej5neTAHonhGIY05kKWdvpcEko7t4L68eURsYuLqah0dNIhB%2FI%2FJqo0UFKuibi%2FepH5i9UHXIX%2Bt1SU2sqQ5p1Ma3eyt4hvgsoZrmqvmHAunZ3dRTXiz2O%2BWgzLJlzzPD85c7Pqy2KMM7ag0jpI4sA2nqt2fOW1d8Xfeh7mPrlNLTHHtLLArHtFjYBNZm7stPiExvseWJmaWF13wC3

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.