KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
A patched flaw in KnowledgeDeliver LMS was exploited as a zero-day to drop Godzilla web shells and later Cobalt Strike Beacon.
Intelligence analysis by GPT-5.4 Mini
Google Mandiant says attackers used a hard-coded ASP.NET machine-key flaw in KnowledgeDeliver LMS to gain remote code execution, implant a web shell, and then stage a second payload that delivered Cobalt Strike Beacon to targeted users.
A school software system had a hidden weak spot. Bad people found it first and used it like a back door.
After getting in, they left a sneaky helper program on the computer, then changed a page so students would see a fake warning and click a fake download. It was like putting a fake detour sign on a road.
The big lesson is that if many buildings all use the same key, losing one key can open many doors. Using different keys and watching for strange file changes helps stop that.
Analysis
What happened
Google Mandiant and Google Threat Intelligence Group say an unknown threat actor exploited a now-patched flaw in Digital Knowledge KnowledgeDeliver LMS as a zero-day before February 24, 2026. The issue, tracked as CVE-2026-5426 and rated 7.5, came from hard-coded ASP.NET machine keys that allowed unauthenticated remote code execution through a ViewState deserialization attack.
The abuse fits a broader pattern Google says it has been tracking since Microsoft documented public ASP.NET machine-key abuse in February 2025. In KnowledgeDeliver, the vendor’s standard web.config file reportedly reused the same machineKey values across deployments. That means a key taken from one installation could potentially help attack other internet-facing instances.
How the intrusion progressed
According to Google, the attacker used the access to inject malicious code into the LMS and then deployed the Godzilla, also called BLUEBEAM, web shell. That gave the operator command execution and the ability to drop more payloads. The attacker also changed file permissions to give “Everyone” full access to the web application directory, which made later tampering easier.
The report says the attacker then altered an application JavaScript file to show a fake security alert that pushed users to install a supposed “security authentication plugin.” Behind that prompt, a malicious script loaded from an attacker-controlled domain and lured victims into downloading a fake installer. That installer ultimately infected machines with Cobalt Strike Beacon.
Why it stands out
Google says the payload was encrypted with a key that used the compromised organization’s name, suggesting the attack was prepared specifically for that target. The main lesson is blunt: shared secrets in deployment templates can turn one mistake into a repeatable compromise across many systems.
Key points
- Google says KnowledgeDeliver LMS was exploited before it was patched.
- The flaw was tied to hard-coded ASP.NET machine keys and ViewState deserialization.
- Attackers deployed the Godzilla web shell and then used it to stage more activity.
- The intruders modified web files to show a fake security alert and push a fake plugin download.
- The final payload delivered Cobalt Strike Beacon to victim machines.
