Hard-coded ASP.NET machine keys in KnowledgeDeliver LMS abused to drop Godzilla, then Cobalt Strike

Attackers exploited CVE-2026-5426, a high-severity flaw (CVSS 7.5) in Digital Knowledge's KnowledgeDeliver Learning Management System, as a zero-day to drop the Godzilla web shell and then stage Cobalt Strike Beacon on compromised hosts. The root cause is the worst kind of boring: hard-coded ASP.NET machineKey values shipped inside the product, identical across every customer install.

KnowledgeDeliver is widely deployed in Japan across universities, vocational schools, and enterprise training portals. That gives any working exploit a usefully large target pool. The vendor has now released a patched build; unpatched instances exposed to the internet should be treated as compromised until proven otherwise.

How the bug works

ASP.NET uses the machineKey (validation and decryption keys) to sign and encrypt __VIEWSTATE, __EVENTVALIDATION, forms-auth tickets, and other server-trusted blobs. When those keys are static and known — whether leaked, hard-coded, or pulled from a public sample — an attacker can craft a ViewState payload that the server will deserialize as trusted input. This is the same ViewState deserialization sink that has burned Telerik UI, Sitecore, and a long tail of internal ASP.NET apps for years. It is a classic .NET deserialization primitive, and it goes straight to RCE under the worker process identity.

In the KnowledgeDeliver intrusions, operators used the forged ViewState to write the Godzilla Chinese-language web shell to disk, then used Godzilla's AES-encrypted command channel for hands-on-keyboard work before staging a Cobalt Strike Beacon for persistence and lateral movement. Godzilla followed by Beacon is a tradecraft pattern strongly associated with China-nexus crews and adjacent contractors. The choice of toolset is not, by itself, attribution.

A few details worth flagging for defenders. Forged ViewState requests typically arrive as POSTs to legitimate ASPX endpoints with an oversized __VIEWSTATE parameter and no valid session context. The IIS worker process (w3wp.exe) spawning cmd.exe or powershell.exe is the cleanest signal. And rotating the machine key is mandatory after patching, because the patch ships new defaults but does not invalidate the old ones an attacker already has.

Digital Knowledge's fix replaces the static keys with per-instance values. That closes the immediate vector. But every operator who pulled the old keys before the advisory still holds them, and any backup, container image, or staging clone built on the vulnerable release will continue to validate forged payloads until its keys are rotated by hand. The CVE is patched. The blast radius is not.