Mandiant Details KnowledgeDeliver Exploitation via Shared ASP.NET Machine Keys
Summary
Mandiant linked a KnowledgeDeliver compromise to shared ASP.NET machine keys enabling unauthenticated RCE. The actor deployed BLUEBEAM and tampered with JavaScript to deliver Cobalt Strike BEACON; the report provides hunting and mitigation guidance.
Key points
- Mandiant investigated a late-2025 compromise of a KnowledgeDeliver web server.
- Identical pre-shared ASP.NET machine keys across deployments enabled crafted __VIEWSTATE payloads to trigger unauthenticated remote code execution; the issue is tracked as CVE-2026-5426.
- The actor deployed the in-memory BLUEBEAM web shell, also known as Godzilla, within the IIS worker process to run commands and payloads.
- The actor changed web-directory permissions and modified JavaScript to display a fake security alert and load a malicious script.
- The fake installer delivered a Cobalt Strike BEACON backdoor to users’ workstations.
- Mandiant recommends monitoring ASP.NET Event ID 1316, unusual child processes from w3wp.exe, web-root file changes, and anomalous concatenated user-agent strings.
- The recommended mitigation is to generate a unique, cryptographically strong machine key for each KnowledgeDeliver instance.
Article Details
- Attack Vectors
- Unauthenticated ViewState deserialization through the __VIEWSTATE parameter, enabled by identical pre-shared ASP.NET machine keys across KnowledgeDeliver deployments, allowed remote code execution.
- The attacker deployed the BLUEBEAM in-memory web shell in the IIS worker process and used it to execute commands through HTTP POST requests.
- The attacker modified web files and JavaScript to display a fake security alert and load a remote malicious script; users were then prompted to download a fake installer that delivered Cobalt Strike BEACON.
- Defensive Notes
- Generate a unique, cryptographically strong ASP.NET machine key for each KnowledgeDeliver instance to invalidate the shared secret.
- If possible, restrict LMS access to known organizational IP address ranges.
- Monitor Windows Application logs for ASP.NET Event ID 1316 and Event code 4009 ViewState verification messages; the article notes that an invalid ViewState message may indicate attempted deserialization but does not by itself confirm payload execution.
- Monitor for unusual child processes spawned by w3wp.exe, including cmd.exe, whoami, and powershell.exe.
- Use file integrity monitoring for unauthorized changes to .js, .aspx, and .config files in the web root, and investigate remote script loaders or unusual changes to commonly used libraries.
- Review web request logs for anomalous concatenated User-Agent strings.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2 | SHA-256 hash identified for the BLUEBEAM web shell payload, LoadLibrary.dll. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Cobalt Strike BEACON payload was encrypted with a key using the compromised organization’s name.T1059.003 · Windows Command ShellCommands including cmd.exe /c and whoami were run through the compromised web server.T1105 · Ingress Tool TransferA remote malicious script and fake installer were used to deliver additional payloads.T1190 · Exploit Public-Facing ApplicationThe attacker exploited the internet-facing KnowledgeDeliver vulnerability for unauthenticated remote code execution.T1204.002 · Malicious FileUsers were prompted by a fake security alert to download and run a fake installer that delivered Cobalt Strike BEACON.T1222.001 · Windows PermissionsThe attacker used icacls to grant Everyone full access to the web application directory.T1505.003 · Web ShellThe attacker deployed the BLUEBEAM in-memory web shell to execute commands via HTTP POST requests.
CVE
Malware
BlueBeamThe threat actor deployed the BLUEBEAM web shell, tampered with web files, and lured users into installing a fake plugin that ultimately delivered Cobalt Strike BEACON.Cobalt Strike BeaconThe threat actor deployed the BLUEBEAM web shell, tampered with web files, and lured users into installing a fake plugin that ultimately delivered Cobalt Strike BEACON.GodzillaBLUEBEAM, a .NET in-memory web shell also known as Godzilla, was deployed to maintain access and execute commands.
Vendors
Digital KnowledgeMandiant investigated a compromise of KnowledgeDeliver, a Japanese LMS from Digital Knowledge, caused by a shared ASP.NET machine key weakness that enabled unauthenticated RCE and was tracked as CVE-2026-5426.MandiantMandiant investigated a compromise of KnowledgeDeliver, a Japanese LMS from Digital Knowledge, caused by a shared ASP.NET machine key weakness that enabled unauthenticated RCE and was tracked as CVE-2026-5426.
Products
ASP.NETMandiant investigated a compromise of KnowledgeDeliver, a Japanese LMS from Digital Knowledge, caused by a shared ASP.NET machine key weakness that enabled unauthenticated RCE and was tracked as CVE-2026-5426.IIS[T1055] Process Injection – BLUEBEAM operated entirely in memory within the IIS worker process, making its activity harder to detect.KnowledgeDeliverMandiant investigated a compromise of KnowledgeDeliver, a Japanese LMS from Digital Knowledge, caused by a shared ASP.NET machine key weakness that enabled unauthenticated RCE and was tracked as CVE-2026-5426.