Hackers Use Fake Cisco AnyConnect and Google Update Installers to Drop SharkLoader

**SharkLoader campaign:** Researchers uncovered SharkLoader, a sophisticated loader used to deliver Cobalt Strike and follow-on tools across government, diplomatic, and software targets in multiple countries; the attackers use fake installers and exploitation of internet-facing vulnerabilities, employ DLL sideloading and in-memory execution to evade detection, and perform credential theft, AD enumeration, LSASS dumping and lateral movement — defenders are advised to patch exposed services, hunt for DLL side-loading and in-memory activity, and monitor behavioral indicators.