Komari Red: The Monitoring Tool with a Built-in Reverse Shell

Reported 30 Apr 2026 by otx · Severity: medium

On April 16, 2026, a threat actor leveraged stolen VPN credentials to access a Windows workstation and deployed a SYSTEM-level backdoor using the Komari agent, an open-source monitoring tool with built-in command-and-control capabilities. The attacker authenticated through an SSL