Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

According to Mandiant Threat Defense, Google’s threat researchers discovered a now-patched flaw in Gladinet’s Triofox file-sharing and remote access platform, tracked as CVE-2025-12480, with a CVSS score of 9.1 that allows an attacker to bypass authentication and access configuration pages. The threat cluster UNC6485 was observed weaponising the flaw as far back as 24 August 2025, nearly a month after Gladinet released patches for version 16.7.10368.56560.

Mandiant said the attacker used the unauthenticated configuration pages to create a new native admin account, Cluster Admin, and then performed follow-on activities. To achieve code execution, the attacker logged in with the new Admin account and used the built-in antivirus feature to download an installer for Zoho Unified Endpoint Management System and deploy remote access tools such as Zoho Assist and AnyDesk.

The attackers reportedly set up an encrypted tunnel to a C2 server over port 433 via SSH to enable inbound RDP traffic, with the broader campaign including password changes and attempts to add accounts to local administrators and Domain Admins for privilege escalation.