UNC6485

UNC6485 is a threat cluster tracked by Google Threat Intelligence Group (GTIG)/Mandiant that has been observed exploiting the Gladinet Triofox vulnerability CVE-2025-12480 as early as August 24, 2025. The activity involved an HTTP Host header attack, setting the Host header to "localhost" to bypass authentication and access Triofox configuration and setup pages. UNC6485 used this access to rerun the initial setup process and create a new native administrative account named "Cluster Admin," then abused Triofox’s built-in anti-virus feature to execute attacker-controlled scripts with SYSTEM privileges. Observed post-exploitation activity included uploading and executing a batch script, downloading a disguised Zoho UEMS installer from 84.200.80[.]252, and deploying Zoho Assist and AnyDesk for persistent remote access. Mandiant also observed use of renamed PuTTY and Plink utilities (including silcon.exe and sihosts.exe) to establish SSH reverse tunnels, including tunneling RDP externally over port 433. Additional reported follow-on actions included reconnaissance, enumeration of SMB sessions and user accounts, attempted password changes, and attempts to add accounts to local administrators and Domain Admins groups. Mandiant detected related staging activity such as file downloads to C:\WINDOWS\Temp. The cluster is directly associated in the provided content with exploitation of Triofox; no further attribution or nation-state linkage is stated.