Hackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature

Cybersecurity researchers from Mandiant Threat Defense have uncovered a critical zero-day in Gladinet’s Triofox file-sharing platform, tracked as CVE-2025-12480, which allowed attackers to bypass authentication and run code with system-level privileges. The exploitation, alleged to have been used by the threat actor group UNC6485 as early as 24 August 2025, targeted Triofox version 16.4.10317.56372 and was patched in release 16.7.10368.56560.

The attack unfolded in two steps: first, by manipulating HTTP host headers to bypass authentication, with localhost used to gain access to restricted configuration pages, and then by abusing Triofox’s built-in anti-virus feature after an administrator account named “Cluster Admin” was created.

The attackers configured the anti-virus scanner path to point to their malicious batch script, enabling deployment of tools such as Zoho remote access software, AnyDesk, and SSH tunnelling utilities like Plink and PuTTY, under full SYSTEM privileges. Mandiant detected the intrusion within 16 minutes using Google Security Operations, and organisations are urged to upgrade to version 16.7.10368.56560 or later and audit administrator accounts and anti-virus configurations to hunt for attacker tools. According to Mandiant Threat Defense, monitoring for unusual outbound SSH traffic can help identify ongoing compromises.