Hackers Exploit Important Flaw in Triofox File Sharing Product

Cyber risk actors have been exploiting a vulnerability in Gladinet’s Triofox, a file-sharing and distant entry platform, and chained it with the abuse of the built-in anti-virus characteristic to realize code execution.

The risk exercise cluster conducting the exploit is tracked as UNC6485 by Google’s Mandiant Risk Protection and Google Risk Intelligence Group (GTIG), in accordance with a new report printed on November 10.

The vulnerability, CVE-2025-12480, was found and reported by Mandiant on November 10. It’s a important improper entry management flaw (CVSS: 9.8) affecting Triofox variations previous to 16.7.10368.56560.

When exploited, it permits an attacker to achieve entry to preliminary setup pages even after setup is full, enabling the add and execution of arbitrary payloads. 

Google contacted Gladinet earlier than disclosing the vulnerability.

The tech big confirmed that the software program proprietor released a patched version of Triofox, 16.7.10368.56560, in June.

Nevertheless, the exploitation marketing campaign began in August, with UNC6485 exploiting CVE-2025-12480 on older variations of Triofox.

How UNC64485 Exploited CVE-2025-12480

Mandiant detected the malicious marketing campaign whereas responding to a safety incident and assessed that it began on August 14, 2025.

The researchers recognized an anomalous entry within the HTTP log file – a localhost host header – which they described as “extremely irregular” in a request originating from an exterior supply and “usually not anticipated in official visitors.”

“The investigation revealed an unauthenticated entry vulnerability that allowed entry to configuration pages. UNC6485 used these pages to run the preliminary Triofox setup course of to create a brand new native admin account, Cluster Admin, and used this account to conduct subsequent actions,” wrote the Mandiant and GTIG researchers within the report.

Mandiant found that attackers exploited an HTTP Host header vulnerability by spoofing localhost in requests, bypassing entry controls to achieve the usually restricted AdminDatabase.aspx setup web page.

By abusing this misconfiguration, the place the CanRunCriticalPage() operate relied solely on the unvalidated host header, they triggered the Triofox initialization course of, creating a brand new native ‘Cluster Admin’ account with full privileges.

The flaw stemmed from lacking origin validation and over-reliance on the host header, permitting unauthenticated distant entry to important configuration pages.

To attain code execution, the attackers logged in utilizing the newly created Admin account and uploaded malicious information to execute them utilizing the built-in anti-virus characteristic.

To arrange the anti-virus characteristic, the person is allowed to supply an arbitrary path for the chosen anti-virus. The file configured because the anti-virus scanner location inherits the Triofox mum or dad course of account privileges, operating underneath the context of the SYSTEM account.

The attackers had been capable of run their malicious batch script by configuring the trail of the anti-virus engine to level to their script.

Then, by importing an arbitrary file to any printed share inside the Triofox occasion, the configured script shall be executed.

After gaining preliminary entry, the attackers deployed a disguised Zoho Unified Endpoint Administration System (UEMS) installer through PowerShell to drop Zoho Help and AnyDesk for distant management.

The attackers then used these instruments to enumerate Server Message Block (SMB) periods, escalate privileges by modifying area/admin group memberships and exfiltrate credentials.

For persistence and evasion, they established an SSH tunnel through Plink/PuTTY to their command-and-control (C2) server, enabling covert distant desktop protocol (RDP) entry over port 433 whereas masking visitors as official distant administration exercise.

Improve Triofox, Audit Admin Accounts and Hunt for Attacker Instruments

Whereas the CVE-2025-12480 vulnerability has been patched since June, the malicious marketing campaign recognized by Mandiant exhibits proof that risk actors had been exploiting unpatched Triofox variations in August.

Subsequently, the GTIG report urged Triofox customers not solely to improve to the newest launch but in addition beneficial auditing admin accounts and verifying that Triofox’s Anti-virus Engine will not be configured to execute unauthorized scripts or binaries.

“Safety groups also needs to hunt for attacker instruments utilizing our searching queries listed on the backside of this submit and monitor for anomalous outbound SSH visitors,” the report concluded.

One other vulnerability affecting Triofox, tracked as CVE-2025-11371, was just lately added to the US Cybersecurity and Infrastructure Safety Company’s (CISA) Known Exploited Vulnerabilities (KEV) catalog.