Hackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature

Cybersecurity researchers from Mandiant Threat Defense have uncovered a critical zero-day vulnerability in Gladinet’s Triofox file-sharing platform that allowed attackers to bypass authentication and execute malicious code with system-level privileges.The vulnerability, tracked as CVE-2025-12480, was actively exploited by the threat actor group UNC6485 as early as August 24, 2025.exploitation chainThe flaw affected Triofox version 16.4.10317.56372 and has since been patched in release 16.7.10368.56560.AttributeDetailsCVE IDCVE-2025-12480VendorGladinetProductTriofoxVulnerability TypeUnauthenticated Access Control / Host Header InjectionSeverityCriticalCVSS Score9.8 (estimated)How the Attack WorkedThe exploitation chain involved a sophisticated two-step process. First, attackers manipulated HTTP host headers to bypass authentication controls.By simply changing the host header value to “localhost” in their web requests, hackers gained unauthorized access to critical configuration pages that should have been restricted.The vulnerability existed in the CanRunCriticalPage() function within Triofox’s codebase.Anti-virus engine path set to a malicious batch scriptThe function incorrectly trusted the HTTP host header without validating that requests originated from localhost, allowing remote attackers to spoof the source of the connection.After gaining initial access, UNC6485 created a new administrator account named “Cluster Admin” through the compromised setup interface.They then logged in and exploited a second weakness in Triofox’s built-in anti-virus feature.Overview of the post-exploitation activityThe attackers discovered they could configure the anti-virus scanner path to point to their own malicious batch script instead of legitimate security software.When files were uploaded to shared folders, Triofox automatically executed the configured “anti-virus” scanner which was actually the attacker’s payload with full SYSTEM account privileges.This technique enabled UNC6485 to deploy multiple tools, including Zoho remote access software, AnyDesk, and SSH tunneling utilities such as Plink and PuTTY.The threat actors used these tools to establish encrypted connections to their command-and-control servers, enumerate system information, and attempt privilege escalation by adding compromised accounts to the Domain Admins group.Mandiant detected the intrusion within 16 minutes using Google Security Operations, identifying suspicious deployment of a remote access utility and unusual file activity in temporary directories.Security teams observed anomalous HTTP log entries showing external requests with localhost referrer headers, a clear indicator of the exploitation attempt.Organizations running Triofox should immediately upgrade to version 16.7.10368.56560 or later.Security teams should audit all administrator accounts for unauthorized entries, verify anti-virus engine configurations, and hunt for attacker tools using Mandiant’s published detection queries. Monitoring for unusual outbound SSH traffic can help identify ongoing compromises.Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.