StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon

Gbhackers •Mayura Kathir • June 25, 2026

During a recent investigation into activity affecting a diplomatic mission in Indonesia, researchers uncovered a previously undocumented loader family they named SharkLoader. What began as an isolated incident rapidly expanded into a multi-country campaign tracked as StrikeShark where SharkLoader consistently serves as the initial loader that ultimately deploys a Cobalt Strike Beacon on compromised hosts. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StrikeShark Campaign Unleashes SharkLoader Malware to Deploy Cobalt Strike A new malware family named SharkLoader has been discovered, linked to a campaign called StrikeShark, which targets various sectors, including a diplomatic organization in Indonesia. SharkLoader acts as a loader to deploy Cobalt Strike Beacon on compromised systems. The campaign exploits vulnerabilities in internet-facing applications such as Microsoft Exchange (CVE-2021-26855), Openfire (CVE-2023-32315), and GeoServer (CVE-2024-36401). The threat actor employs both exploitation of known vulnerabilities and custom droppers disguised as legitimate software to gain initial access. The campaign has a broad geographic reach, affecting entities in multiple countries, including Taiwan, Colombia, and Lebanon. Current assessments indicate that the threat actor relies on publicly available exploits and has not been definitively attributed to any known group. The situation remains under investigation as researchers continue to analyze the scope and methods used. 14 sources 72

Extracted Entities

StrikeShark Campaign Uses New SharkLoader Malware to Deploy Cobalt Strike Beacon

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Malware (2)

MITRE ATT&CK (1)