Loading story…
A critical improper access control vulnerability in Triofox (CVE-2025-12480, CVSS 9.1) allows attackers to access initial setup pages even after the software has been configured. This flaw, present in versions prior to 16.7.10368.56560, enables unauthenticated users to bypass authentication and access sensitive configuration interfaces. The vulnerability was disclosed and patched by Gladinet, with the update specifically restricting access to these setup pages post-installation.
Despite the availability of a patch, threat actors tracked as UNC6485 have been observed actively exploiting this vulnerability since at least August 2025. Attackers leverage the flaw to create new administrative accounts by rerunning the setup process, then use these accounts to upload and execute arbitrary payloads. Notably, the exploitation chain abuses the built-in antivirus feature, allowing attackers to specify a malicious script as the antivirus engine path, which then executes with SYSTEM privileges. This incident marks the third actively exploited Triofox vulnerability in 2025, highlighting ongoing targeting of the platform by sophisticated threat actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2025-12480 to its KEV catalog, formally recognizing that the Triofox flaw was being exploited in the wild. The listing elevated urgency for defenders to patch and investigate potential compromise.
On November 11, 2025 reporting, Mandiant disclosed technical details of CVE-2025-12480 exploitation, including the Host header bypass, admin account creation, and abuse of the antivirus feature for code execution. The company attributed the activity to UNC6485 and recommended upgrading, auditing admin accounts, and monitoring for suspicious outbound SSH traffic.
Help Net Security reports Gladinet released CentreStack and Triofox version 16.10.10408.56683, which also fixed CVE-2025-12480 and CVE-2025-11371. This later release provided an updated patched version for affected customers.
Post-compromise activity included deployment of Zoho UEMS, Zoho Assist, and AnyDesk, along with internal enumeration, attempted privilege escalation, and plink-like tunneling utilities. These actions established persistence and enabled further movement within victim environments.
After obtaining admin access, attackers configured Triofox's built-in antivirus engine path to run attacker-supplied scripts or payloads with SYSTEM privileges when files were uploaded. This turned the initial authentication bypass into remote code execution on affected servers.
Mandiant observed threat cluster UNC6485 actively exploiting CVE-2025-12480 as early as August 24, 2025. Attackers bypassed Host header validation to access setup pages, create unauthorized admin accounts, and compromise exposed Triofox systems.
Gladinet released Triofox version 16.7.10368.56560, which multiple sources identify as containing a fix for CVE-2025-12480. The flaw allowed improper access control via Host header manipulation that could lead to admin takeover and code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
horizon3.ai
Open sourceblog.alphahunt.io
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting a zero-day vulnerability, CVE-2025-11371, in Gladinet CentreStack and TrioFox file-sharing and remote access platforms. This vulnerability is an unauthenticated local file inclusion (LFI) flaw that allows threat actors to access sensitive system files, including the application’s Web.config file. By retrieving the machine key from this configuration file, attackers can leverage a previously patched vulnerability, CVE-2025-30406, to achieve remote code execution (RCE) through ViewState deserialization attacks. Huntress, a cybersecurity firm, first detected exploitation of this flaw on September 26-27, 2025, and has confirmed that at least three customers have been impacted so far. The vulnerability affects all versions of CentreStack and TrioFox up to and including 16.7.10368.56560, and there is currently no official patch available from Gladinet. Both self-hosted and cloud-hosted deployments of these platforms are at risk, as the flaw impacts default installations and configurations. The exploitation chain involves using the LFI to extract the machine key, which is then used to craft malicious ViewState payloads that bypass integrity checks and enable arbitrary code execution on the server. Notably, Huntress observed successful exploitation even on systems that had already patched CVE-2025-30406, indicating that the previous fix was insufficient to fully mitigate the risk. In response, Huntress and other security experts recommend disabling the "temp" handler within the UploadDownloadProxy Web.config file as an immediate mitigation, though this may impact some platform functionality. Gladinet has acknowledged the vulnerability and its active exploitation but has not yet released a patch, urging customers to implement the recommended mitigations. The affected products are widely used by managed service providers, small businesses, and enterprises for secure file access and sharing, increasing the potential impact of this vulnerability. Attackers exploiting this flaw can gain full control over affected servers, leading to data theft, lateral movement, or further compromise of organizational networks. Security researchers are withholding some technical details to prevent further exploitation while a patch is developed. Organizations using CentreStack or TrioFox should urgently review their configurations and apply the recommended mitigations to reduce exposure. The incident highlights the risks associated with chained vulnerabilities and the importance of defense-in-depth strategies. Ongoing monitoring and threat detection are advised until a permanent fix is available. The situation remains fluid, with active exploitation continuing and the vendor working on a security update.
Jun 29, 2026
Attackers are actively exploiting a critical cryptographic vulnerability in Gladinet's CentreStack and Triofox products, which are used for secure remote file access and sharing. The flaw stems from the use of hard-coded cryptographic keys within the `GladCtrl64.dll` component, allowing threat actors to decrypt or forge access tickets and gain unauthorized access to sensitive files, including `web.config`. This access can be leveraged to obtain machine keys and achieve remote code execution via ViewState deserialization. Security researchers from Huntress have observed at least nine organizations targeted by these attacks, with exploitation occurring in the wild and Gladinet issuing advisories and updates to mitigate the risk. The vulnerability is rooted in a custom implementation of the AES algorithm, where static 100-byte strings are used to derive encryption keys and initialization vectors, making them identical across all installations. Attackers can craft malicious requests to the `/storage/filesvr.dn` endpoint, bypassing authentication and impersonating users. Gladinet has provided indicators of compromise (IoCs) and urged customers to update to the latest versions released on November 29. The attacks highlight the risks of insecure cryptographic practices and the importance of timely patching in enterprise environments.
Jun 29, 2026
The Clop ransomware group has initiated a widespread data extortion campaign targeting Internet-exposed Gladinet CentreStack and Triofox file servers. Attackers are exploiting multiple vulnerabilities, including CVE-2025-11371 (an unauthenticated local file inclusion flaw), CVE-2025-14611 (hardcoded cryptographic keys), and CVE-2025-12480 (a critical remote code execution vulnerability in Triofox). These vulnerabilities allow unauthorized access, file retrieval, and even remote code execution, enabling Clop to steal sensitive corporate data and leave ransom notes on compromised systems. Security researchers and incident responders have observed active exploitation across at least 200 unique IP addresses, with evidence that both zero-day and unpatched n-day vulnerabilities are being leveraged. Gladinet CentreStack and Triofox are widely used by businesses for secure file storage and sharing, making the impact of these attacks potentially significant. The Clop group’s campaign follows their established pattern of targeting file transfer and sharing solutions, having previously compromised platforms such as MOVEit, GoAnywhere, and Oracle EBS. Security updates have been released by Gladinet to address some of the exploited flaws, but the ongoing attacks highlight the importance of timely patching and monitoring of Internet-facing file sharing infrastructure. Technical analysis by VulnCheck and Mandiant has provided detailed insights into the exploitation methods, emphasizing the complexity and sophistication of the attack chain.
Jun 29, 2026