Shark

MITRE ATT&CK: S1019 View on attack.mitre.org

Aliases: Atom, Shark, SHARK

First seen
2021-07-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Related IoCs
2 (1 malicious)
Last IoC activity
2026-06-30 13:47:24
Profile updated
2026-07-07 15:46:15

Targeted industries: energy-and-utilities government-and-public-sector technology-and-telecommunications

Context

Shark is a backdoor malware written in C# and .NET that is an updated version of Milan; it has been used by HEXANE since at least July 2021.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to Shark (S1019). The 1 most recently updated:

TypeIndicatorUpdatedSources
URL http://totalsoundrecording.com/upload/alex/postal.exe 2026-02-10 1

Detection coverage

  • 1 YARA rules
  • 244 Sigma rules

Malware & tools used

  • Ingress Tool Transfer (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • Query Registry (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Fallback Channels (attack-pattern)
  • Data from Local System (attack-pattern)
  • System Checks (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • File Deletion (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Web Protocols (attack-pattern)
  • DNS (attack-pattern)
  • Data Staged (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)

Used by threat actors

Detection rules

  • ARKBIRD_SOLG_MAL_Shark_Aug_2021_1 (yara-rule)

Reports & references

  • prevailion.com — Latest Targets Of Cyber Group Lyceum (report)
  • clearskysec.com — Siamesekitten (report)
  • accenture.com — Iran Based Lyceum Campaigns (report)
  • bleepingcomputer.com — The Shark Ransomware Project Allows To Create Your Own Customized Ransomware (report)
  • bleepingcomputer.com — Shark Ransomware Rebrands As Atom For A Fresh Start (report)
  • clearskysec.com — Siamesekitten (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Shark (report)
  • MITRE ATT&CK — S1019 (report)
  • security-database.com — Shark 3 Remote Administration Tool (report)
  • lpc1.clpccd.cc.ca.us — Ethical Hacking Lab 05 (report)

External references