StrikeShark

Threat-actor developments: Russia-nexus espionage broadens; new China-nexus and DPRK clusters

The most significant new actor finding the dailies did not carry is Turla's STOCKSTAY — Google GTIG characterised a multi-component .NET/Windows Forms backdoor that communicates C2 over secure WebSocket and shares significant code overlap with Kazuar (Turla's staple implant since 2017). Delivery used malicious RDP files by phishing and, as recently as November 2025, RAR archives exploiting WinRAR's CVE-2025-8088 (a flaw also abused by Sandworm, Gamaredon and RomCom). Current targeting is Ukrainian government and military, but earlier victims had Italian, Dutch, Polish and German foreign-policy interest — a direct read-across for Swiss federal and European governmental entities with Ukraine-adjacent policy work (The Hacker News). This sits alongside the week's other Russia-nexus signal: FBI/CISA escalated their warning that Russian intelligence (tracked as UNC5792) is now phishing Signal Backup Recovery Keys for persistent account takeover, and ESET's Gamaredon retrospective (§ 7) shows the FSB-linked group moving exfil and C2 wholesale onto trusted cloud services.

Two non-Russian clusters round out the picture. Unit 42 documented CL-STA-1062, a Chinese-speaking cluster (overlapping Talos's UAT-7237) deploying the new TinyRCT .NET backdoor via AppDomainManager injection against Southeast-Asian government and state-owned energy targets (Unit 42); Kaspersky GReAT analysed the StrikeShark cluster's SharkLoader deploying Cobalt Strike via "Perfect DLL Hijacking" against government targets (Securelist). And SentinelLABS' macOS.Gaslight, a DPRK-aligned Rust backdoor, notably turns prompt injection on the LLM-assisted analyst rather than the sandbox (SentinelLABS) — an early instance of tradecraft built specifically to poison AI-assisted triage. Attribute the claim to the research outfit, not the state, where the source itself hedges.

Kaspersky GReAT: "StrikeShark" loader deploys Cobalt Strike via "Perfect DLL Hijacking" against government targets

Kaspersky GReAT published a full technical analysis (2026-06-26) of SharkLoader, an undocumented loader used in a cluster it tracks as StrikeShark and assesses with low confidence as a Chinese-speaking actor (based on the Chinese-authored FScan/Searchall/Pillager toolkit it deploys) (Kaspersky Securelist, 2026-06-24). The loader's signature is "Perfect DLL Hijacking": it sideloads through legitimate signed binaries (SystemSettings.exe, msedge.exe), then forcibly releases LdrpLoaderLock and decrements LdrpWorkInProgress so it can spawn threads from DllMain without deadlocking the Windows loader — an unusually sophisticated pattern. Two encrypted modules (DscCoreR.mui, Blowfish; SyncRes.dat, AES-128) install Microsoft Detours hooks across 50+ APIs to null ETW (EtwEventWrite), spoof svchost.exe as parent PID (T1134.004), and demote Beacon memory from RWX to RW during sleep via MinHook on VirtualAlloc/Sleep to evade memory scanners (Help Net Security, 2026-06-26). Initial access is via a long list of public-facing RCEs (ProxyLogon CVE-2021-26855, Openfire CVE-2023-32315, GeoServer CVE-2024-36401, F5 BIG-IP CVE-2023-46747, FortiOS CVE-2024-21762), with European targets including North Macedonia and Serbia. Why it matters to us: Swiss/EU organisations still exposed on any of the listed CVE versions are in the initial-access set. Hunt for SystemSettings.exe executing from %APPDATA% subdirectories, PrintDialog.dll loaded outside system32 (Sysmon EID 7), and processes whose ETW subsystem produces zero events.