StrikeShark SharkLoader - AppData Staging DLL Drop or Rogue SystemSettings.dll Sideload

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects components of the StrikeShark campaign, specifically the staging of SharkLoader payloads within specific AppData subdirectories (%APPDATA%\xwreg or %APPDATA%\xgdf) and the sideloading of a rogue SystemSettings.dll by the legitimate SystemSettings.exe process from an unauthorized location.