Komari Red: The Monitoring Tool with a Built-in Reverse Shell

What it is

A Huntress case study of a single-workstation intrusion (April 16, 2026 UTC) that supplies concrete IOCs and detection heuristics the summary omits. Initial access was a FortiGate SSLVPN login as [User 1] from 45.153.34[.]132 — an address resolving to VMHeaven[.]io hosting (Netherlands, ASN 51396), previously seen by Huntress as SSLVPN egress and staging infrastructure.

How it works

The operator's host announced itself to AD as workstation VM8514 and drove type-3 network logons into the target from the FortiGate-assigned tunnel IP 10.212.134[.]200. It enabled Remote Registry (Event ID 7040: disabled → demand start), attempted a hive dump (secretsdump-style over MS-RRP), then ran a customized Impacket smbexec.py chain parented to services.exe under NT AUTHORITY\SYSTEM, ending in a PowerShell one-liner that pulled the Komari agent and registered it as a SYSTEM service named "Windows Update Service."

Preconditions / Affected

Valid VPN credentials on an internet-facing FortiGate SSLVPN, plus enough access to enable Remote Registry and run remote SMB command execution as SYSTEM on the target.

What to do

Hunt for these specific artifacts:

• Network: connections to/from 45.153.34[.]132; any SSLVPN egress from VMHeaven[.]io / ASN 51396.
• Komari: PowerShell fetching from raw.githubusercontent[.]com/komari-monitor/komari-agent; a SYSTEM service named "Windows Update Service" (Komari's control channel is on by default — treat any Komari agent as live C2).
• Customized smbexec: randomized 8-char batch filenames and __output_<random> pipes parented to services.exe. Vanilla Impacket ships a static service name BTOBTO and a plain __output filename — the presence of randomized artifacts (e.g. SCnRMUvT, BPzrQOLa, HBBJLmCW, PlYHZsEC, output suffix _iDhLsdpD) indicates a fork built to evade signatures, so don't rely on the BTOBTO static-string detection.
• Naming heuristic: flag AD workstation names matching VM + four digits with no domain suffix or asset-tag prefix (e.g. VM8514) as possible disposable operator VMs.
• Registry dumping: Defender Behavior:Win32/RegDump.SA (Event ID 1116) on svchost.exe; a compressed hive-sized drop such as C:\Windows\Temp\aRhRnnHI.tmp.

Caveats

Defender quarantined the RegDump.SA staging file, but Huntress states the actor had already escalated to SYSTEM and the dumping action had completed — the quarantine did not prevent credential access, so a successful Defender block here is not evidence of containment. The fetched text is truncated before the four decoded smbexec commands and any final remediation guidance.