Critical Triofox Vulnerability Exploited in the Wild

According to Google, a threat actor tracked as UNC6485 exploited a critical Triofox vulnerability to obtain remote access and then create a new administrator account. The flaw, CVE-2025-12480 (CVSS 9.1), was resolved in late July by preventing access to initial configuration pages after setup, and Triofox prior to version 16.7.10368.56560 was affected.

In late August, the attackers used an HTTP Host header attack to access AdminDatabase.aspx, then AdminAccount.aspx and InitAccount.aspx to forge a new admin account, exploiting ASP.NET’s reliance on the host header and the lack of localhost verification.

They subsequently abused a built-in antivirus feature to run a malicious file via an arbitrary path, publishing a share containing a batch script that fetched a second-stage payload matching Zoho Unified Endpoint Management System installers, and then used Zoho Assist and AnyDesk for remote access. UNC6485 also used two utilities to set up an encrypted SSH tunnel to its C2 server and attempted to modify passwords and add accounts to local and domain administrators.

Organisations are advised to update to version 16.7.10368.56560 or newer, audit administrator accounts, and ensure the Triofox antivirus engine cannot execute unauthorized scripts or binaries.