StrikeShark Campaign Hits Governments via Old Bugs and Fake Installers

Kaspersky researchers have stitched together what started as a single odd-looking attack on a diplomatic body in Indonesia and turned out to be something much bigger. They're calling it StrikeShark, and the victim list now spans government organisations in Taiwan, software developers in several countries, and assorted targets in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal and Serbia.

The way in is unglamorous. The attackers either exploit known flaws in internet-facing gear from Microsoft, Fortinet, Cisco, F5, Zimbra, Apache and Hikvision, or they trick someone into running a dodgy installer. Some of the bugs go back to 2016. All of them have public proof-of-concept code floating around, which means this is less elite tradecraft and more shopping from the open shelves.

Meet SharkLoader

The genuinely new piece is a dropper Kaspersky has named SharkLoader. It has been spotted masquerading as a Cisco AnyConnect VPN installer and a Google Update utility, often paired with decoy PDFs that look the part. The lures include a technical document on liquid rocket engine design and another on biological treatment processes, which gives you a sense of who the attackers think they're talking to.

Once the loader runs, it drops a Cobalt Strike beacon, disguises its components as normal Windows files, and disables the logging that defenders would normally use to notice any of this happening. From there the attackers pull credentials out of Windows memory and Active Directory and start moving laterally.

Whose hands are on the keyboard

Kaspersky cannot pin the activity to a known group. The post-exploitation tooling was written by Chinese-speaking developers and posted to GitHub, but open-source tooling tells you very little about who is actually using it. The targeting profile leans toward espionage, although no confirmed data theft has been reported yet.

The boring detail that matters

The uncomfortable thing about StrikeShark is not the dropper or the decoys. It's the age of the vulnerabilities being used. A bug from 2016 is still pulling its weight in 2026 because somewhere, on someone's perimeter, an unpatched appliance is still answering the phone.

• Public PoCs are the default entry route. If a CVE has working exploit code online, assume someone is trying it against you right now.
• Installers remain a reliable lure. A Cisco AnyConnect or Google Update prompt still gets clicks, especially when paired with a convincing PDF.
• Logging gets turned off early. If your detection depends on Windows event logs alone, an attacker who's already inside will quietly close that window.

None of the individual pieces here are clever. The campaign works because enough organisations have not patched, enough staff will run an installer that looks legitimate, and enough networks are flat enough inside that one foothold opens everything else.