Kaspersky GReAT: "StrikeShark" loader deploys Cobalt Strike via "Perfect DLL Hijacking" against government targets
Kaspersky GReAT published a full technical analysis (2026-06-26) of SharkLoader, an undocumented loader used in a cluster it tracks as StrikeShark and assesses with low confidence as a Chinese-speaking actor (based on the Chinese-authored FScan/Searchall/Pillager toolkit it deploys) (Kaspersky Securelist, 2026-06-24). The loader's signature is "Perfect DLL Hijacking": it sideloads through legitimate signed binaries (SystemSettings.exe, msedge.exe), then forcibly releases LdrpLoaderLock and decrements LdrpWorkInProgress so it can spawn threads from DllMain without deadlocking the Windows loader — an unusually sophisticated pattern. Two encrypted modules (DscCoreR.mui, Blowfish; SyncRes.dat, AES-128) install Microsoft Detours hooks across 50+ APIs to null ETW (EtwEventWrite), spoof svchost.exe as parent PID (T1134.004), and demote Beacon memory from RWX to RW during sleep via MinHook on VirtualAlloc/Sleep to evade memory scanners (Help Net Security, 2026-06-26). Initial access is via a long list of public-facing RCEs (ProxyLogon CVE-2021-26855, Openfire CVE-2023-32315, GeoServer CVE-2024-36401, F5 BIG-IP CVE-2023-46747, FortiOS CVE-2024-21762), with European targets including North Macedonia and Serbia.
Why it matters to us: Swiss/EU organisations still exposed on any of the listed CVE versions are in the initial-access set. Hunt for SystemSettings.exe executing from %APPDATA% subdirectories, PrintDialog.dll loaded outside system32 (Sysmon EID 7), and processes whose ETW subsystem produces zero events.
ATT&CK mapping
1 technique mapped from the cited reporting · MITRE ATT&CK v19.2
Privilege Escalation TA0004
T1134.004Access Token Manipulation: Parent PID Spoofing
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use. This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.
Stealth TA0005
T1134.004Access Token Manipulation: Parent PID Spoofing
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use. This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.