[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcjkEV5EVlozUZgBuQjl2dYjLHPSmTE-poOhTG5XiJ08":3},{"article":4,"iocs":53,"watch_terms":93,"solutions":94,"lesson":198},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"6b91d4bc-fd8a-4697-95e9-9519bf4724c8","New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks","new-sharkloader-malware-deploys-cobalt-strike-in-strikeshark-cyberattacks-106115","A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark, said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan,","A new malware family named SharkLoader has been identified, acting as a loader for Cobalt Strike Beacon in the StrikeShark campaign. This campaign has targeted diplomatic and government organizations across Indonesia, Taiwan, and other countries, as well as software development companies. The attackers are believed to be Chinese-speaking and are leveraging various known vulnerabilities for initial access, including ProxyLogon and ProxyNotShell.","New SharkLoader malware deploys Cobalt Strike in StrikeShark cyberattacks targeting diplomatic and government entities.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fnew-sharkloader-malware-deploys-cobalt.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjsnAZNjHSEX7UtabbKNVn68uohH8pK5LKuU2CgckZTJowWHxYmEjx9ROquO9tFsThy-3_759_ko2TQEX4Wm3PI1Y-opfzyeAzW8Tni0-gz2YMtPMln9XQRzcKq1mviZSTW7MNShxVRhbuUXBSuNGTNStlwj_NCfFsyrptpXvkLNt5CUfARwENz0IshNDma\u002Fs1600\u002Fshark.jpg","2026-06-26T18:17:46+00:00","2026-06-26T20:00:23.1277+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"StrikeShark","campaign",{"name":21,"type":22},"Kaspersky","vendor",{"name":24,"type":25},"Exchange Server","product",{"name":27,"type":25},"Openfire",{"name":29,"type":25},"GeoServer","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,64,67,70,73,76,79,82,85,88,90],{"type":55,"value":56,"context":57},"cve","CVE-2021-26855","Exploited for initial access via Exchange Server flaws (ProxyLogon)",{"type":55,"value":59,"context":60},"CVE-2023-32315","Path traversal vulnerability impacting Openfire",{"type":55,"value":62,"context":63},"CVE-2024-36401","Remote code execution bug in GeoServer",{"type":55,"value":65,"context":66},"CVE-2016-4437","Apache Shiro vulnerability",{"type":55,"value":68,"context":69},"CVE-2021-36260","Hikvision Products vulnerability",{"type":55,"value":71,"context":72},"CVE-2021-27076","Microsoft SharePoint vulnerability",{"type":55,"value":74,"context":75},"CVE-2022-27925","Zimbra Collaboration Suite vulnerability",{"type":55,"value":77,"context":78},"CVE-2022-41082","Microsoft Exchange Server vulnerability (ProxyNotShell)",{"type":55,"value":80,"context":81},"CVE-2023-46747","F5 BIG-IP vulnerability",{"type":55,"value":83,"context":84},"CVE-2024-21762","Fortinet FortiOS vulnerability",{"type":55,"value":86,"context":87},"CVE-2025-55182","React Server Components vulnerability",{"type":55,"value":89,"context":84},"CVE-2022-40684",{"type":55,"value":91,"context":92},"CVE-2023-20198","Cisco IOS XE Web UI vulnerability",[21,24,27],{"controls":95,"vendors":179},[96,125,150],{"slug":97,"name":98,"problem":99,"products":100},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":126,"name":127,"problem":128,"products":129},"patch-management","Automated patch management","Known holes get closed in days, not months.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":126,"product_name":147,"url":148,"description":149},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":151,"name":152,"problem":153,"products":154},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[155,163,171],{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":172,"vendor_name":173,"vendor_logo":174,"product_slug":175,"product_name":176,"url":177,"description":178},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[180,186,191,196],{"slug":181,"name":182,"logo_path":183,"roles":184},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[185],"affected",{"slug":187,"name":188,"logo_path":189,"roles":190},"f5","F5","\u002Fvendor-logos\u002Ff5.png",[185],{"slug":192,"name":193,"logo_path":194,"roles":195},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[185],{"slug":172,"name":173,"logo_path":174,"roles":197},[185],{"slug":199,"title":200,"body":201,"framework_refs":202,"framework_notes":215},"sharkloader-exploits-unpatched-exchange-flaws-to-deploy-cobalt-strike","SharkLoader Exploits Unpatched Exchange Flaws to Deploy Cobalt Strike","The StrikeShark campaign demonstrates how threat actors continue to weaponize well-known, publicly disclosed vulnerabilities — specifically ProxyLogon and ProxyNotShell — long after patches have been available, highlighting chronic patch management failures in high-value environments. By deploying SharkLoader as a stealthy intermediary, attackers can introduce Cobalt Strike Beacon without triggering immediate detection, establishing persistent footholds in diplomatic and government networks. This matters because Cobalt Strike provides adversaries with a full post-exploitation toolkit, enabling lateral movement, credential theft, and data exfiltration. The targeting of government and diplomatic organizations raises serious national security implications, and the persistence of these attacks underscores that delayed patching and insufficient network monitoring remain critical organizational weaknesses.",[203,204,205,206,207,208,209,210,211,212,213,214],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1105: Ingress Tool Transfer","MITRE ATT&CK T1071: Application Layer Protocol (C2)","NIST SP 800-137: Continuous Monitoring","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]