Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The attacker exploited the KnowledgeDeliver web server through a public-facing vulnerability to gain unauthenticated RCE. [‘A critical vulnerability that allowed unauthenticated Remote Code Execution (RCE).’]
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – The attacker ran commands such as icacls, whoami, and cmd.exe /c through the web server process. [‘Commands observed include: cmd.exe /c … whoami powershell.exe’]
• [T1055] Process Injection – BLUEBEAM operated entirely in memory within the IIS worker process, making its activity harder to detect. [‘This malware operates entirely in memory within the IIS worker process (w3wp.exe).’]
• [T1105] Ingress Tool Transfer – A remote malicious script was loaded from a threat actor-controlled domain and a fake installer was used to deliver additional payloads. [‘Silently load a remote malicious script hosted on a threat actor-controlled domain.’]
• [T1112] Modify Registry or File Permissions – The attacker used icacls to grant Everyone full access to the web application directory. [‘Permission Modification: The threat actor used icacls to grant “Everyone” full access to the web application directory.’]
• [T1505.003] Server Software Component: Web Shell – The actor deployed the BLUEBEAM web shell to execute further commands via HTTP POST requests. [‘The threat actor deployed a .NET-based in-memory web shell called BLUEBEAM (also known as Godzilla).’]
• [T1056.001] Input Capture: Keylogging – The fake security alert prompted users to install a “security authentication plugin,” tricking them into executing the malicious flow. [‘Display a fake security alert, prompting users to install a “security authentication plugin”.’]
• [T1027] Obfuscated Files or Information – The payload was encrypted with a key tied to the compromised organization, indicating tailored payload encryption. [‘The payload was encrypted using a key that used the name of the compromised organization.’]
• [T1499] Endpoint Denial of Service – Not observed in a destructive sense, but the exploit leveraged deserialization and malformed ViewState handling that triggered integrity failures in logs. [‘Viewstate verification failed. Reason: The viewstate supplied failed integrity check.’]