Triofox Zero-Day Exploited in Real-World Attacks — Hackers Turn Anti-Virus Feature into System-Level Backdoor
Triofox Zero-Day Exploited in Real-World Attacks — Hackers Turn Anti-Virus Feature into System-Level Backdoor
Cybersecurity researchers from Mandiant Threat Defense have uncovered a critical zero-day vulnerability in Gladinet’s Triofox file-sharing platform, allowing attackers to bypass authentication and execute code with full system privileges.
Tracked as CVE-2025-12480, the flaw was actively exploited by threat group UNC6485 beginning in August 2025, targeting enterprise environments using Triofox version 16.4.10317.56372.
Gladinet has since patched the issue in version 16.7.10368.56560, but unpatched deployments remain vulnerable.
🧠 The Exploitation Chain: Bypassing Authentication and Abusing Built-In Defenses
Mandiant’s analysis reveals a two-stage exploitation process that weaponized Triofox’s own security mechanisms against its users.
Step 1 — Authentication Bypass via HTTP Host Header Manipulation
Attackers modified the HTTP host header in requests to spoof “localhost”, tricking the Triofox platform into believing the request originated from the server itself.
The flaw, located in the CanRunCriticalPage() function, failed to properly validate request origins, allowing remote adversaries to access administrative configuration pages and create unauthorized accounts.
Step 2 — Abusing the Anti-Virus Integration Feature
Once authenticated, the attackers leveraged Triofox’s anti-virus scanning configuration to execute arbitrary commands.
By changing the AV scanner path to a malicious batch script, UNC6485 transformed Triofox’s automated file-scanning process into a malware deployment mechanism.
When files were uploaded, Triofox automatically launched the script — executing it under the SYSTEM account, the highest privilege level in Windows environments.
This allowed the attackers to:
Deploy remote access tools such as Zoho Assist and AnyDesk
Use SSH tunneling utilities (Plink and PuTTY) to exfiltrate data
Establish encrypted command-and-control channels
Add compromised accounts to the Domain Admins group for persistent access
⚙️ Forensic Evidence and Detection
Mandiant’s telemetry identified the breach within 16 minutes, detecting suspicious file activity and unauthorized process launches inside temporary directories.
Security analysts observed unusual HTTP log entries showing external requests containing localhost referrer headers — a key indicator of CVE-2025-12480 exploitation attempts.
🧩 Elliptic Systems Analysis: The Irony of Inverted Defense
The Triofox zero-day underscores a growing trend: attackers hijacking legitimate security tools as entry points for exploitation.
By abusing the product’s own anti-virus execution routine, UNC6485 effectively turned a defensive control into a weaponized delivery mechanism.
“This is more than a code flaw — it’s a design-level blind spot,” Elliptic Systems analysts noted. “When a file-sharing service trusts its own anti-virus configuration without integrity checks, it opens the door for privilege escalation and full compromise.”
The case exemplifies the increasing convergence between system misconfigurations, API abuse, and privilege manipulation — hallmarks of modern enterprise intrusions.
🛡️ Elliptic Systems’ Recommendations
To mitigate this threat and prevent recurrence, Elliptic Systems advises:
✅ Immediate Upgrade
Update all Triofox installations to version 16.7.10368.56560 or later.
✅ Audit Administrative Accounts
Inspect for unauthorized “Cluster Admin” accounts or other anomalies in privileged roles.
✅ Verify Anti-Virus Engine Paths
Ensure that Triofox’s AV configuration points to a legitimate, signed scanner binary — not an external script.
✅ Network Monitoring
Hunt for unusual outbound SSH, RDP, or AnyDesk traffic patterns that may indicate persistence.
✅ Implement Zero Trust Controls
Restrict Triofox server access through network segmentation and application whitelisting.
✅ Leverage Threat Intelligence
Use Mandiant’s detection queries and IOCs to perform retrospective analysis of logs and endpoints.
🧠 The Bigger Picture: Internal Trust is the New Attack Surface
The Triofox incident highlights a harsh reality:
Every trusted process inside an enterprise network is a potential threat vector.
Attackers increasingly exploit legitimate product features — not just vulnerabilities — to evade detection and maintain long-term access.
Elliptic Systems’ takeaway:
“Security features are no longer off-limits to attackers. If it runs with privilege, it’s fair game. The new rule for defenders is simple — assume compromise, verify everything, and trust nothing.”
