Threat Actor Used Komari Monitoring Agent as a SYSTEM-Level Backdoor in VPN Intrusion
Summary
Huntress details an intrusion using stolen VPN credentials and Impacket to install Komari as a persistent SYSTEM-level backdoor. The partner network was isolated before the operator issued Komari commands; no data loss was reported.
Key points
- The actor accessed a partner environment using stolen VPN credentials, then used Impacket smbexec.py to enable RDP on a Windows workstation.
- The actor installed Komari from its official GitHub repository and registered it as a persistent SYSTEM-level service named “Windows Update Service.”
- Komari’s agent accepts remote command execution, interactive terminal, and network-probing events by default over a persistent WebSocket.
- Microsoft Defender quarantined a registry-dumping attempt, but the actor had already obtained SYSTEM access on the workstation.
- Huntress says the tool’s WebSocket traffic can resemble ordinary HTTPS, complicating network-based detection.
- Huntress isolated the workstation and partner network and disabled the compromised account before any Komari command or terminal session was observed; it reported no data loss.
Article Details
- Attack Vectors
- The actor used stolen VPN credentials to establish an SSLVPN session and enter the partner environment.
- From the VPN tunnel, the actor used Impacket smbexec.py over SMB to execute commands, attempt registry-hive dumping, and enable RDP by changing a registry setting and firewall rule.
- The actor used an interactive RDP session to download Komari's installer from the official GitHub repository and install the agent as a SYSTEM-level Windows service named "Windows Update Service".
- The Komari agent maintained a persistent outbound WebSocket to the operator's server, providing a bidirectional command channel; Huntress reported that no post-install command execution or terminal sessions were observed.
- Defensive Notes
- Huntress isolated the affected workstation and disabled the compromised account at the partner's domain controller.
- Huntress isolated every device on the partner network because the environment lacked MFA and additional credential compromise could not be ruled out.
- Huntress recommends hunting for processes that maintain long-lived outbound WebSockets to unfamiliar hosts and periodically spawn shells or PowerShell processes not initiated by users.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]153[.]34[.]132 | Source IP for the actor's SSLVPN session using stolen credentials. |
| SHA256 | 039e659ade3aa8ee7758c11fdb8fbfffd2491920046d638413cea2042f6d584c | SHA-256 of the Komari agent binary installed as a SYSTEM-level backdoor in the intrusion. |
MITRE ATT&CK
T1003.002 · Security Account ManagerThe actor attempted registry-hive dumping; Microsoft Defender quarantined a RegDump.SA-related artifact.T1021.001 · Remote Desktop ProtocolAfter enabling RDP, the actor connected interactively to the workstation over RDP.T1021.002 · SMB/Windows Admin SharesThe actor used Impacket smbexec.py over SMB to execute commands remotely on the workstation.T1059.001 · PowerShellA PowerShell command retrieved the Komari installer, and the agent's first-contact process spawned PowerShell to run its inventory script.T1059.003 · Windows Command ShellThe actor used cmd.exe during remote command execution and in the interactive RDP session.T1071.001 · Web ProtocolsThe installed Komari agent used a persistent WebSocket over TLS to communicate with its server.T1078 · Valid AccountsThe actor authenticated to the SSLVPN using stolen credentials for [User 1].T1105 · Ingress Tool TransferThe actor retrieved the Komari installer from the official GitHub repository onto the workstation.T1112 · Modify RegistryThe actor changed the Terminal Server registry setting to enable RDP.T1133 · External Remote ServicesThe actor established an SSLVPN session to access the partner environment.T1219 · Remote Access ToolsThe actor installed Komari, a legitimate remote-control and monitoring agent, as a persistent command channel.T1543.003 · Windows ServiceThe actor used NSSM to register komari-agent.exe as an automatically restarting Windows service running as SYSTEM.T1569.002 · Service ExecutionThe smbexec.py command chain executed commands through a service running under services.exe.
Products
Fortinet FortiGateThe first event in this story isn't on the workstation; it's on the FortiGate.KomariKomari: The “Monitoring” Tool That Didn't Need WeaponisingMicrosoft Defender Antimalware PlatformMicrosoft Defender caught and quarantined an earlier Behavior:Win32/RegDump.SA attempt against svchost.exe, forcing the adversary to pivot away from registry hive dumping and into a “C2 living off the trust of GitHub.”Microsoft WindowsOn April 16, 2026, a threat actor used stolen VPN credentials to pivot into a Huntress partner Windows workstation and dropped a SYSTEM-level backdoor using the Komari agent - a 4.3k-star, MIT-licensed, Go-based project
Tools
ImpacketFrom that tunnel IP, Impacket smbexec.py was used to enable RDP on [REDACTED-WRKSTN], and the Komari agent was installed from an interactive RDP session.NSSMThe operator installed Komari as a persistent Windows service named “Windows Update Service” via NSSM (the “Non-Sucking Service Manager”), pulling the installer directly from the official Komari GitHub repository.smbexec.pyFrom that tunnel IP, Impacket smbexec.py was used to enable RDP on [REDACTED-WRKSTN], and the Komari agent was installed from an interactive RDP session.