A critical security flaw in the KnowledgeDeliver learning management system was actively exploited by hackers to deploy malicious web shells and backdoors, according to new findings from Google Mandiant.
Quick Summary – TLDR:
- Attackers exploited CVE-2026-5426, a high severity flaw in KnowledgeDeliver LMS.
- The bug allowed hackers to execute code remotely using hardcoded ASP.NET machine keys.
- Threat actors deployed the Godzilla web shell and later infected systems with Cobalt Strike Beacon.
- Google Mandiant warned that all KnowledgeDeliver deployments before February 24, 2026 were vulnerable.
What Happened?
Researchers at Google Mandiant uncovered active exploitation of a serious security vulnerability affecting KnowledgeDeliver, a Learning Management System widely used in Japan for enterprise and educational e learning.
The flaw, tracked as CVE-2026-5426, allowed attackers to gain unauthorized remote access to vulnerable servers and deploy malware capable of maintaining long term persistence inside compromised environments.
🚨 One shared key. Every deployment at risk.
— The Hacker News (@TheHackersNews) May 26, 2026
Attackers exploited CVE-2026-5426 in the KnowledgeDeliver LMS to gain unauthenticated RCE through hard-coded ASP-NET machineKeys, deploy the Godzilla (BLUEBEAM) web shell, and deliver Cobalt Strike Beacon on vulnerable internet-facing… pic.twitter.com/QdoUvGHnmH
How the Attack Worked?
The vulnerability existed because older KnowledgeDeliver deployments used a standardized web.config file containing hardcoded ASP.NET machineKey values. These keys are responsible for encrypting and signing data inside ASP.NET applications, including ViewState payloads.
Because the same machine keys were reused across multiple customer installations, attackers who obtained the keys from one deployment could potentially compromise any other exposed KnowledgeDeliver instance connected to the internet.
Google Mandiant explained the attack process clearly:
This attack technique relies on ViewState deserialization, a long known weakness in ASP.NET applications. Similar attacks were previously observed targeting Sitecore and CentreStack systems.
Godzilla Web Shell Deployed in Memory
After gaining access, attackers deployed the Godzilla web shell, also known as BLUEBEAM. The malware runs directly inside the IIS worker process called w3wp.exe, making it significantly harder for traditional antivirus products to detect.
The web shell allowed attackers to:
- Execute remote commands
- Deploy additional payloads
- Modify server permissions
- Maintain persistence inside compromised systems
Mandiant observed attackers using icacls commands to grant full access permissions to the web application directory for “Everyone“. This effectively gave threat actors broader control over the compromised server environment.
Researchers also detected suspicious child processes launched from w3wp.exe, including:
- cmd.exe
- powershell.exe
- whoami
These activities strongly indicated post exploitation behavior.
Fake Security Alerts Used to Trick Users
One of the more dangerous aspects of the campaign involved tampering with JavaScript files hosted by the application.
Attackers modified existing JavaScript code to silently load malicious scripts from attacker controlled domains. At the same time, users visiting the compromised LMS platform were shown fake security warnings urging them to install a “security authentication plugin.“
The fake installer ultimately delivered Cobalt Strike Beacon, a widely abused penetration testing framework frequently used in real world cyberattacks.
According to Google Mandiant, the malware payload appeared highly targeted.
Organizations Urged to Rotate Machine Keys
Mandiant warned that all KnowledgeDeliver deployments before February 24, 2026 should be considered vulnerable if they remain unpatched.
The company advised organizations to immediately:
- Rotate ASP.NET machine keys.
- Restrict LMS access to trusted IP ranges.
- Monitor Event ID 1316 logs for ViewState exploitation attempts.
- Check for unauthorized modifications to JavaScript, ASPX, and config files.
- Investigate suspicious activity involving w3wp.exe child processes.
Researchers also published indicators of compromise and threat hunting guidance to help defenders identify signs of exploitation.
Why This Attack Matters?
The incident highlights the massive security risk created when vendors reuse shared secrets across customer deployments. A single leaked key can effectively expose an entire ecosystem of systems to compromise.
The attack also demonstrates how threat actors continue to abuse legitimate frameworks like Cobalt Strike and memory resident web shells to avoid detection and maintain long term access.
SQ Magazine Takeaway
I think this attack is another reminder that even enterprise software vendors still make dangerous mistakes with basic security design. Reusing machine keys across customer installations is the kind of issue that can quietly become a disaster years later. What makes this case more alarming is how attackers moved beyond server compromise and started targeting actual users with fake security prompts and malware installers. Organizations running internet facing platforms simply cannot afford weak default configurations anymore.
