Executive Summary

Today's pattern is the failure of trusted business paths: SaaS identity, shared application secrets and employee software sourcing.

The three incidents selected from today's Daily Breach Intelligence report are not isolated news items. Charter shows how vishing against a Microsoft Entra account can lead to Salesforce data export and extortion pressure. KnowledgeDeliver shows how hard-coded ASP.NET machine keys can convert a learning platform into unauthenticated remote code execution, web shell deployment, and workstation compromise. Microsoft's cryptojacking research shows how poisoned search and AI-assisted discovery paths can result in DLL sideloading, ScreenConnect abuse, process hollowing, Defender exclusions, and GPU mining.

CISO takeaway: Treat trusted paths as breach surfaces. The 72-hour priority is to validate SaaS export controls, rotate shared application secrets, hunt for IIS and RMM abuse, and move employee software installation toward managed catalogs with telemetry-backed exceptions.

Shared Secret, Shared Blast Radius

Hard-coded ASP.NET machine keys can turn ViewState protection into an unauthenticated execution path across multiple deployments.

What Happened

Mandiant reported exploitation of CVE-2026-5426 in KnowledgeDeliver, a learning management system used commonly in Japan. Deployments before 24 February 2026 used a standardized web.config with identical ASP.NET machineKey values. Once an attacker had the keys, they could craft malicious ViewState payloads and reach unauthenticated remote code execution on exposed instances.

Observed post-exploitation activity included BLUEBEAM/Godzilla web shell deployment inside w3wp.exe, file permission changes with icacls, JavaScript tampering, fake security plugin prompts, and Cobalt Strike delivery to users visiting the compromised LMS.

Why This Matters

This is a board-relevant application governance failure, not only an LMS bug. Shared deployment secrets create systemic exposure: one recovered key can compromise many independent environments. Training portals, partner-learning systems, and customer education platforms often sit outside the highest-priority application inventory, yet they process identities, documents, session data, and sometimes trusted internal content.

How the Attack Can Unfold

1. Attacker identifies an internet-facing KnowledgeDeliver instance deployed with the shared machine key.
2. A malicious ViewState payload is submitted through the __VIEWSTATE parameter.
3. The server accepts the payload because the attacker can sign or encrypt it with the known machine key.
4. The IIS worker process executes attacker-controlled code and loads an in-memory web shell.
5. The attacker tampers with web content, stages fake installers, and moves from server compromise to endpoint compromise.

Vished Identity, Exported Trust

A single compromised SSO account can become a bulk-export path across SaaS platforms if access and export rights are not governed together.

What Happened

Charter Communications confirmed a data breach after ShinyHunters listed the company for extortion. Charter stated that no sensitive personal information or customer proprietary network information was exfiltrated. The threat actor claimed a broader impact: a 1 April vishing attack against a Microsoft Entra account, followed by export of consumer and business customer records from a Salesforce instance and access to support-ticket data.

The useful security signal is not the disagreement between company and actor statements alone. It is the repeatability of the path: social engineering against identity, access into SaaS, bulk export, and extortion with customer data narratives.

Why This Matters

Salesforce, Microsoft 365, Google Workspace, Zendesk, Slack, Atlassian, SAP, and similar platforms are now breach data planes. They are business-critical systems with broad data visibility, delegated access, APIs, and export features. Traditional identity controls can fail quietly if help-desk processes, BPO accounts, session controls, OAuth grants, and export permissions are not monitored as one operating model.

How the Attack Can Unfold

1. Attacker calls an employee, contractor, or BPO worker and drives a vishing workflow against SSO.
2. The compromised account passes into Microsoft Entra or another identity provider with access to SaaS applications.
3. The attacker enumerates connected SaaS tools, roles, OAuth grants, and data export paths.
4. Customer, support, account, or operational records are exported through native reporting or API functions.
5. The stolen data is used for extortion, follow-on phishing, business email compromise, or pressure during notification decisions.

Fake Utility, Real Remote Access

Poisoned software discovery chains can install legitimate remote-management tooling before dropping miners and hollowing trusted Windows utilities.

What Happened

Microsoft reported a cryptojacking campaign that pushed users searching for software utilities to attacker-controlled domains. In some observed cases, LLM-generated responses included links to domains later associated with the campaign. The fake sites delivered ZIP files containing legitimate utility executables and a malicious autorun.dll for DLL sideloading.

The chain silently installed ScreenConnect, used remote file transfer to drop SimpleRunPE, created hidden install paths, added Defender exclusions, performed anti-analysis checks, and hollowed Microsoft-signed .NET utilities such as InstallUtil.exe, RegAsm.exe, RegSvcs.exe, and MSBuild.exe before launching GPU-focused mining activity.

Why This Matters

This is more than nuisance cryptomining. The campaign exercises a repeatable endpoint intrusion pattern: trust in search results, local execution of a fake utility, legitimate RMM for persistence and operator access, security-control weakening, and execution inside signed Windows processes. The same pattern can support credential theft, data staging, ransomware preparation, or hands-on-keyboard intrusion.

How the Attack Can Unfold

1. Employee searches for a utility and lands on an attacker-controlled download page through poisoned search, sponsored placement, or AI-assisted discovery.
2. A ZIP file runs a legitimate executable that sideloads a malicious DLL from the same folder.
3. The malware installs ScreenConnect and connects to attacker infrastructure.
4. The attacker transfers additional tooling, creates hidden paths, and changes Defender exclusions.
5. The miner runs inside a hollowed Microsoft-signed .NET process, while host and GPU telemetry is sent to command infrastructure.

First 24 Hours

• Identify KnowledgeDeliver and similar ASP.NET LMS or training portals; confirm patch level and unique machine-key status.
• Pull IIS, Windows Application, EDR, and webroot integrity data for exposed LMS hosts before retention windows close.
• Ask identity and CRM owners for Entra high-risk sign-ins, MFA changes, Salesforce exports, API spikes, and connected-app changes affecting support or BPO users.
• Hunt for unexpected ScreenConnect installs, suspicious DLL sideloading from downloads, and Defender exclusion changes.
• Issue targeted guidance: do not install utilities from search results, ads, mirrors, or AI-generated links; use the approved catalog.

24 to 72 Hours

• Rotate shared ASP.NET machine keys and preserve evidence of old and new key deployment.
• Review Salesforce object-level export permissions and remove standing export rights where not required.
• Revoke risky SaaS sessions, refresh tokens, and OAuth grants tied to suspicious identities.
• Tighten RMM allowlists and alert on newly seen RMM clients outside approved tenants.
• Brief legal, privacy, support, and customer communications on the evidence needed before accepting or disputing actor data claims.

30 Days

• Fold training portals, partner portals, and customer education platforms into tiered asset governance.
• Build SaaS export anomaly detection across CRM, support, collaboration, and file-sharing platforms.
• Create an enterprise software-source policy that covers search, ads, package mirrors, community tools, and AI-generated recommendations.
• Test a cross-functional playbook for vishing-to-SaaS compromise: identity, SaaS admin, legal, privacy, support, and communications.