New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

The StrikeShark campaign demonstrates how threat actors continue to weaponize well-known, publicly disclosed vulnerabilities — specifically ProxyLogon and ProxyNotShell — long after patches have been available, highlighting chronic patch management failures in high-value environments. By deploying SharkLoader as a stealthy intermediary, attackers can introduce Cobalt Strike Beacon without triggering immediate detection, establishing persistent footholds in diplomatic and government networks. This matters because Cobalt Strike provides adversaries with a full post-exploitation toolkit, enabling lateral movement, credential theft, and data exfiltration. The targeting of government and diplomatic organizations raises serious national security implications, and the persistence of these attacks underscores that delayed patching and insufficient network monitoring remain critical organizational weaknesses.