- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,592
The Japanese came up with a platform for learning, but forgot to teach it to change its passwords.
In KnowledgeDeliver found a critical vulnerability CVE-2026-5426 (CVSSv3.1/AV:N/C:C/N/UI:N/UI/H/:N) - 9.1 Critical, through which the attackers hacked the server of the training platform and tried to infect the computers of its visitors. KnowledgeDeliver was developed by the Japanese company Digital Knowledge, the system is often used in Japan for distance learning.
Mandiant from the Google Threat Intelligence Group investigated the incident at the end of 2025. They found out that unknown attackers were able to execute commands on the server without logging in. The reason was the same keys of ASP.NET machineKey, which were used in different equipments KnowledgeDeliver.
Installs KnowledgeDeliver, deployed until February 24, 2026, received a standard web.config file from the supplier. In such a file there were predetermined keys with which ASP.NET encrypts and signs data, including ViewState. ViewState stores the status of the web page between user requests.
If an attacker found out the keys from one installation, he could prepare the malicious ViewState and send it to another available from the Internet server KnowledgeDeliver. The server received data such as trustees and tried to process it, which allowed to execute malicious code.
After the hack, the attackers entrenched on the server using the BLUEBEAM web sheath, also known as Godzilla. The malware worked in the memory of the IIS w3wp.exe process, so if you check the files by conventional methods, traces of infection could not be detected. Through encrypted HTTP POST queries, attackers could transmit commands and run additional malicious components.
The attackers then changed the rights to access the web application catalog with icacls and gave the Everyone full access to the group. After that, they introduced malicious code into the JavaScript file. Visitors to the site were shown a fake security warning and offered to install a “subcoagible module for authentication”. At the same time, the page downloaded a remote malicious scenario from a domain controlled by an attacker.
The fake installer infected Cobalt Strike BEACON workstations. The payload was encrypted with the key, which used the name of the compromised organization. Such a detail indicates that the attackers prepared a malicious file specifically for a specific purpose.
Mandiant advises KnowledgeDeliver administrators to urgently replace machineKey with unique and cryptographically resistant keys for each installation. Such a step drops the general secret, due to which it became possible to attack. It is also recommended to restrict access to the trusted address training control system, check Windows logs on ASP.NET events with code 1316, search for suspicious subsidiaries w3wp.exe, including cmd.exe, whoami and powershell.exe, as well as check the changes in the .js, .aspx and .config files.
In KnowledgeDeliver found a critical vulnerability CVE-2026-5426 (CVSSv3.1/AV:N/C:C/N/UI:N/UI/H/:N) - 9.1 Critical, through which the attackers hacked the server of the training platform and tried to infect the computers of its visitors. KnowledgeDeliver was developed by the Japanese company Digital Knowledge, the system is often used in Japan for distance learning.
Mandiant from the Google Threat Intelligence Group investigated the incident at the end of 2025. They found out that unknown attackers were able to execute commands on the server without logging in. The reason was the same keys of ASP.NET machineKey, which were used in different equipments KnowledgeDeliver.
Installs KnowledgeDeliver, deployed until February 24, 2026, received a standard web.config file from the supplier. In such a file there were predetermined keys with which ASP.NET encrypts and signs data, including ViewState. ViewState stores the status of the web page between user requests.
If an attacker found out the keys from one installation, he could prepare the malicious ViewState and send it to another available from the Internet server KnowledgeDeliver. The server received data such as trustees and tried to process it, which allowed to execute malicious code.
After the hack, the attackers entrenched on the server using the BLUEBEAM web sheath, also known as Godzilla. The malware worked in the memory of the IIS w3wp.exe process, so if you check the files by conventional methods, traces of infection could not be detected. Through encrypted HTTP POST queries, attackers could transmit commands and run additional malicious components.
The attackers then changed the rights to access the web application catalog with icacls and gave the Everyone full access to the group. After that, they introduced malicious code into the JavaScript file. Visitors to the site were shown a fake security warning and offered to install a “subcoagible module for authentication”. At the same time, the page downloaded a remote malicious scenario from a domain controlled by an attacker.
The fake installer infected Cobalt Strike BEACON workstations. The payload was encrypted with the key, which used the name of the compromised organization. Such a detail indicates that the attackers prepared a malicious file specifically for a specific purpose.
Mandiant advises KnowledgeDeliver administrators to urgently replace machineKey with unique and cryptographically resistant keys for each installation. Such a step drops the general secret, due to which it became possible to attack. It is also recommended to restrict access to the trusted address training control system, check Windows logs on ASP.NET events with code 1316, search for suspicious subsidiaries w3wp.exe, including cmd.exe, whoami and powershell.exe, as well as check the changes in the .js, .aspx and .config files.
