SharkLoader Drops Cobalt Strike on Asian Government Targets in 'StrikeShark' Campaign
A previously undocumented loader is being used against a diplomatic office in Indonesia and government bodies in Taiwan, with operators staging Cobalt Strike Beacon as the final payload.
A new loader family called SharkLoader is being used to plant Cobalt Strike Beacon on targeted government networks across Southeast and East Asia, according to research from Kaspersky tracking the activity as StrikeShark.
The targeting is narrow. Known victims include a diplomatic organization in Indonesia and government organizations in Taiwan. That profile — diplomatic and state targets in the region — is consistent with espionage rather than commodity crimeware, though attribution has not been published.
SharkLoader itself is the new artifact here. It functions as a stager, with the operational job of pulling down and executing Cobalt Strike Beacon on compromised hosts. Cobalt Strike, of course, needs no introduction: cracked and leaked builds have been a fixture of intrusion sets for years, and defenders should treat any Beacon callout as a full-host compromise until proven otherwise.
What is worth flagging is the choice to ship a bespoke loader at all. Threat actors investing in a custom delivery component — rather than reaching for one of the open-source shellcode loaders already on GitHub — generally do so to defeat specific EDR or YARA coverage they've already tested against. That implies pre-engagement reconnaissance of the target's tooling, or at minimum a desire for longer dwell time than off-the-shelf loaders provide.
The public reporting so far does not detail the initial access vector, the persistence mechanism, or the C2 infrastructure used by the Beacon payloads. Hashes and network indicators tied to StrikeShark have not been broadly circulated at the time of writing. (If you have telemetry from the affected regions, the Kaspersky writeup is the primary reference to map against.)
For defenders, the practical takeaways are unglamorous but familiar.
Hunt for Beacon. Named-pipe patterns, default or lightly modified Malleable C2 profiles, and the well-documented stager URI conventions are still catching real intrusions. Beacon's sleep-mask and process-injection behaviors leave artifacts in memory that EDR memory scanners pick up reliably when policies are tuned for detection rather than prevention-only mode.
Review egress from diplomatic and government environments to low-reputation hosting. StrikeShark's victimology suggests the operators are willing to burn infrastructure on small numbers of high-value targets, which usually means short-lived VPS C2 nodes rather than compromised CDN fronting.
Treat any new loader family in your environment as a deliberate signal. SharkLoader is the visible piece; the interesting question is what the operators are doing post-Beacon — credential theft, lateral movement to mail systems, or staging for longer-term implants. None of those will show up in the loader telemetry itself.
Kaspersky has not, as of publication, named individual researchers on the StrikeShark write-up. Expect IOCs to firm up as more victims are identified.
