Hackers Abuse KnowledgeDeliver LMS Flaw to Install BLUEBEAM Web Shell

Hackers are actively exploiting a critical vulnerability in the KnowledgeDeliver Learning Management System (LMS) to deploy the BLUEBEAM web shell, according to findings from Mandiant’s Google Threat Intelligence Group.

The flaw, tracked as CVE-2026-5426, enables unauthenticated remote code execution through ASP.NET ViewState deserialization and has been observed in real-world attacks.

KnowledgeDeliver LMS Flaw

The vulnerability affects KnowledgeDeliver installations deployed before February 24, 2026, which relied on a standardised configuration containing hardcoded ASP.NET machineKey values.

These keys are used to secure ViewState data, which maintains application state across requests. Because identical keys were reused across multiple environments, attackers could reuse a known key to target any exposed instance.

By crafting a malicious ViewState payload and delivering it through the __VIEWSTATE parameter, threat actors can trigger deserialization on the server and execute arbitrary code.

Mandiant noted that this technique closely resembles previous ViewState deserialization attacks, including those targeting Sitecore, as well as campaigns involving publicly disclosed ASP.NET machine keys. This reinforces the broader risk associated with shared cryptographic secrets in enterprise applications.

Following successful exploitation, attackers deployed BLUEBEAM, also known as Godzilla, a .NET-based in-memory web shell. The malware operates داخل the IIS worker process (w3wp.exe), allowing attackers to execute commands remotely via encrypted HTTP POST requests.

Because it resides in memory rather than on disk, BLUEBEAM is significantly harder to detect using traditional file-based security tools.

Post-exploitation activity included modifying file permissions using icacls to grant full access to web directories, as well as tampering with JavaScript files within the application.

The attackers injected malicious code that displayed fake security alerts urging users to install a fraudulent authentication plugin while silently loading external scripts from the attackers’ infrastructure.

In some cases, victims who installed the fake plugin were infected with a Cobalt Strike BEACON backdoor, with payloads tailored to the targeted organization.

To detect such activity, organizations should monitor Windows Application logs for Event ID 1316, which may indicate ViewState validation failures or exploitation attempts.

Security teams should also look for suspicious processes spawned by w3wp.exe, unexpected modifications to web application files, and anomalous User-Agent strings that combine multiple browser signatures in a single request.

To mitigate the risk, organizations are strongly advised to rotate ASP.NET machine keys immediately and ensure each deployment uses unique, cryptographically secure values. Restricting access to trusted IP ranges, implementing file integrity monitoring, and conducting thorough threat hunting can further reduce exposure.

This campaign highlights the critical security risks of using shared secrets in application deployments. A single exposed key can enable widespread compromise across multiple organizations, underscoring the need for secure configuration practices and continuous monitoring.

Indicators of Compromise (IOCs)

File Name	Type	SHA-256
LoadLibrary.dll	BLUEBEAM	7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.