Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver . KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated Remote Code Execution (R…

https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability

sha256:6744a25220bf77c0a4e739bac6bb6567521fd189dcceb6eac8b4e364c1bde9bf

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve1
md50
url0
ipv42
ipv60
sha10
domain9
sha2561
malware_token1
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	cmd.exe	Open →
domain	powershell.exe	Open →
domain	asp.net	Open →
ip	121.0.0.0	Open →
ip	1.9.2.13	Open →
domain	web.config	Open →
domain	w3wp.exe

Malware families

Allowlist token matches only.

Cobalt Strikemalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports