KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike Ravie LakshmananMay 26, 2026Vulnerability / Threat Intelligence A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LMS) popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon. The vulnerability, tracked as CVE-2026-5426 (CVSS score: 7.5), stems from the use of hard-coded ASP.NET machine keys, leading to unauthenticated remote code execution via a ViewState deserialization attack. The abuse of publicly disclosed ASP.NET machine keys by threat actors was first documented by Microsoft in February 2025. "An unknown threat actor leveraged this access to inject malicious code into the LMS platform, with the goal of infecting users visiting the site," Google Mandiant and Google Threat Intelligence Group (GTIG) said. The security flaw impacted Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026. It's worth noting that similar vulnerabilities in Sitecore Experience Manager (XM) and Gladinet CentreStack and TrioFox have also been exploited by threat actors. The problem is rooted in the fact that KnowledgeDeliver installations relied on a standardized web.config file provided by the vendor that contained hard-coded machineKey values used by the ASP.NET framework to encrypt and sign data, including ViewState payloads. As a result, a threat actor who manages to obtain the keys from one deployment could leverage them to compromise other internet-facing KnowledgeDeliver instances. "The ASP.NET ViewState persists page state across postbacks," Google said. "When the machineKey is known, a threat actor can craft a malicious ViewState payload. By sending this payload in an HTTP request (via the __VIEWSTATE parameter), the threat actor can make the server deserialize it." In the activity observed in connection with CVE-2026-5426, attackers have been found to deploy the Godzilla (aka BLUEBEAM) web shell, granting them the ability to run commands or drop additional payloads. Among the commands executed were instructions to escalate their control over the web server's file system by granting "Everyone" complete access to the web application directory. Subsequently, the threat actor tampered with an application JavaScript file to include code that displayed a fake security alert, urging users to install a "security authentication plugin." In tandem, the unauthorized modifications made it possible to stealthily load a malicious script hosted on an attacker-controlled domain. The script, in turn, convinced users to download a fake installer, ultimately infecting the machines with Cobalt Strike Beacon. "The payload was encrypted using a key that used the name of the compromised organization, which indicated that the threat actor prepared this payload specifically for the targeted organization," Google said. "The exploitation of KnowledgeDeliver highlights the severe risks of using shared secrets in deployment templates. A single leaked key can compromise an entire ecosystem of installations. By implementing unique secrets and robust endpoint monitoring, organizations can defend against these deserialization attacks." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Cobalt Strike, cybersecurity, Google Mandiant, remote code execution, Threat Intelligence, Vulnerability, Web Shell, Zero-Day ⚡ Top Stories This Week NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows The New Phishing Click: How OAuth Consent Bypasses MFA MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros Microsoft Warns of Two Actively Exploited Defender Vulnerabilities Developer Workstations Are Now Part of the Software Supply Chain Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension Load More ▼ ⭐ Featured Resources Claim ANY.RUN Anniversary Offer for Faster Malware Analysis [Guide] Get Key Identity Security Insights From 2026 Snapshot [Guide] Learn to Detect AI Typosquatting Risks in Your Domain Discover How to Navigate the Era of Constant Cyber Exposure