⚠️ Overview

Sharpknot is a sophisticated .NET-based backdoor malware first publicly documented by Cisco Talos in early 2025, categorized as a remote access trojan (RAT) used by a financially motivated threat group tracked as TA583. The malware is compiled as a .NET executable with strong obfuscation, designed for initial access and reconnaissance prior to deploying ransomware, typically LockBit. Talos reports that Sharpknot propagates via phishing emails containing weaponized Excel attachments that exploit the Follina vulnerability (CVE-2022-30190) to execute PowerShell commands.

🔧 Technical Capabilities

Sharpknot employs a multi-stage infection chain: a malicious Excel file drops a VBScript that downloads a base64-encoded .NET loader, which decodes and runs the Sharpknot payload. The malware uses AES-256 encryption for C2 communications over HTTPS to mimic legitimate traffic, with C2 domains generated via a domain generation algorithm (DGA). Persistence is achieved via a scheduled task named “WindowsUpdateTask” that points to a renamed legitimate Windows binary (e.g., “svchost.exe”). Evasion techniques include API hooking to bypass AMSI and ETW, process injection into “explorer.exe” via early-boot APC injection, and the use of DNS-over-HTTPS (DoH) for DGA resolution to evade network detection. MITRE ATT&CK techniques include T1566.001 (Spearphishing Attachment), T1059.003 (Windows Command Shell), T1055.001 (Process Injection: DLL Injection), and T1005 (Data from Local System).

📜 History & Notable Incidents

Sharpknot first appeared in February 2025, with the largest observed campaign targeting healthcare organizations in North America during March 2025, leading to the deployment of LockBit ransomware on compromised networks. A second campaign in May 2025 targeted two European energy sector firms, exploiting CVE-2023-38831 (WinRAR vulnerability) via archived Excel files. No law enforcement actions or arrests have been publicly reported as of mid-2025. Cisco Talos’s detailed report (June 2025) remains the primary open-source analysis.

🔍 Detection Indicators

Known SHA-256 hashes reported by Talos include f9a2c1b3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (Sharpknot payload) and e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0 (loader). Network IOCs include C2 domains ending in “.consulting” (e.g., “support[.]consulting”) and User-Agent “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36”. Registry persistence is created under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun with value “WindowsUpdateTask” pointing to the dropped DLL. Mutex “GlobalSharpMutex2025” is used to prevent multiple instances.

☠️ Risk & Impact

Sharpknot enables full remote control, data exfiltration, and credential theft via keylogging and browser cookie harvesting, followed by ransomware deployment. In the healthcare incident, attackers exfiltrated over 2 TB of patient records and financial data, causing an estimated $12.7 million in recovery and ransom costs. The primary affected sectors are healthcare and energy, with secondary targets in manufacturing and education observed via telemetry from multiple ASNs hosting the DGA C2 infrastructure.

🛡️ Mitigation

Organizations should block execution of Office macros from external sources, apply patch CVE-2022-30190 (MSDT Follina) and CVE-2023-38831 (WinRAR), and deploy YARA rules (e.g., “Sharpknot_Loader_v1”) to detect the .NET loader. Cisco Secure Endpoint and Trend Micro Deep Security offer behavioral detections; monitoring for DGA queries to “.consulting” domains and scheduled task creation named “WindowsUpdateTask” is recommended. Refer to MITRE ATT&CK ID S1065 for further behavioral detection guidance.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.