Full Report
Huntress found threat actors using the Komari monitoring agent as a SYSTEM-level backdoor. Learn how they abused GitHub and what defenders should hunt for.
Analysis Summary
# Tool/Technique: Komari Monitoring Agent
## Overview
Komari is an open-source, MIT-licensed monitoring tool written in Go. While marketed as a remote-control and monitoring project for systems administration, it functions as a bidirectional control channel. In April 2026, threat actors were observed utilizing Komari as a SYSTEM-level backdoor by deploying it as a persistent Windows service. Its primary appeal to attackers is its "living off the trust of GitHub" nature, as installers are pulled directly from legitimate repositories, and the tool's core C2 features are enabled by default.
## Technical Details
- **Type:** Malware family (Abused Legitimate Tool / C2 Agent)
- **Platform:** Windows (Targeted in this instance); cross-platform via Go (sh-compatible)
- **Capabilities:** Persistent WebSocket communication, arbitrary command execution, interactive PTY reverse shell, and network probing.
- **First Seen:** Case documented April 16, 2026.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1543.003 - Create or Modify System Process: Windows Service
- **TA0005 - Defense Evasion**
- T1562.001 - Impair Defenses: Disable or Modify Tools (Attempted Registry Dump)
- T1027 - Obfuscated Files or Information (Use of legitimate GitHub infra for staging)
- **TA0008 - Lateral Movement**
- T1021.001 - Remote Services: Remote Desktop Protocol
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (WebSockets)
- T1059.001 - Command and Scripting Interpreter: PowerShell
## Functionality
### Core Capabilities
- **Command Execution (`exec`):** Allows the operator to run arbitrary commands via PowerShell (Windows) or sh (Linux/Unix).
- **Persistent Connectivity:** Establishes a long-lived WebSocket connection to a central server for real-time control.
- **Network Probing (`ping`):** Performs ICMP, TCP, or HTTP probing to facilitate internal reconnaissance from the infected host.
### Advanced Features
- **Interactive Terminal (`terminal`):** Provides a full interactive PTY (Pseudo-Terminal) reverse shell accessible via the operator’s web browser. This feature is enabled by default unless specifically opted out via flags.
- **Service Integration:** Easily integrated with service managers like NSSM to run with SYSTEM-level privileges.
## Indicators of Compromise
- **File Names:**
- `komari-agent.exe`
- `nssm.exe` (used for persistence)
- **Service Names:**
- `Windows Update Service` (Adversary-chosen display name)
- **Network Indicators:**
- `raw.githubusercontent[.]com/komari-monitor/komari-agent` (Staging URL)
- `45.153.34[.]132` (Initial access VPN IP - VMHeaven[.]io)
- `10.212.134[.]200` (Internal tunnel IP)
- **Behavioral Indicators:**
- PowerShell one-liners pulling content from GitHub repositories.
- `cmd.exe` or `powershell.exe` spawning from a service managed by NSSM.
- Unexpected WebSocket traffic to unknown external IPs.
## Associated Threat Actors
- **Unknown:** Currently attributed to a threat actor leveraging stolen VPN credentials (documented by Huntress).
## Detection Methods
- **Signature-based detection:** Monitor for the Komari agent binary (Go-compiled) and NSSM binaries.
- **Behavioral detection:**
- Detect `nssm.exe` creating new services with names that mimic legitimate Windows services (e.g., "Windows Update Service").
- Identify outbound WebSocket connections from non-browser processes, specifically targeting non-standard ports or known VPS providers.
- Alert on PowerShell downloading executables directly from `raw.githubusercontent.com`.
- **Registry Monitoring:** Watch for service creation keys under `HKLM\SYSTEM\CurrentControlSet\Services` pointing to non-standard binaries.
## Mitigation Strategies
- **Multi-Factor Authentication (MFA):** Enforce phishing-resistant MFA on all VPN and remote access portals to prevent initial access via stolen credentials.
- **Application Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unapproved binaries like `nssm.exe` or unauthorized Go agents.
- **Network Segmentation:** Limit the ability of workstations to reach out to raw code repositories (GitHub, GitLab) unless required for specific roles.
- **Service Hardening:** Audit the creation of new Windows Services, especially those running as SYSTEM.
## Related Tools/Techniques
- **Nezha:** Another Go-based monitoring tool frequently abused by China-nexus actors.
- **SimpleHelp / Atera / ScreenConnect:** Legitimate RMM tools commonly repurposed by threat actors for C2 persistence.
- **Impacket (smbexec.py):** Used in conjunction with this attack for lateral movement and enabling RDP.