The software installs itself onto a compromised trading firm’s FPGA (Field-Programmable Gate Array) or RDMA (Remote Direct Memory Access) card. These components are rarely scanned by antivirus because they are not "files" but hardware logic.
Sharkhack: The Apex Predator of Algorithmic Exploitation – A Case Study in Financial Malware Evolution sharkhack software
Sharkhack performs negative latency injection . It identifies outbound order packets from rival algorithms (e.g., a mutual fund’s buy order for Tesla stock). It deliberately delays these packets by 50–200 microseconds—an eternity in HFT. The software installs itself onto a compromised trading