Trioflox exploit facilitates remote access tool delivery

Intrusions exploiting the critical Gladinet Triofox file-sharing and remote access platform flaw, tracked as CVE-2025-12480, have been launched by the UNC6485 threat operation to facilitate compromise with remote access programs since August, reports The Hacker News.

UNC6485 harnessed the already-patched unauthenticated access bug to infiltrate configuration pages and establish a new native admin account, which was subsequently leveraged to execute malicious files through built-in antivirus functionality, according to Google Cloud's Mandiant Threat Defense researchers. Modifying the antivirus engine's path enabled the execution of the illicit batch script, which led to the eventual installation of Zoho Assist for reconnaissance activities.

Aside from altering existing account credentials and upgrading them to local admins for privilege escalation, attackers also sought to permit inbound RDP traffic by creating an encrypted tunnel to a command-and-control server via the Plink and PuTTY tools. Organizations have been urged to not only update their Triofox instances but also evaluate admin accounts and their instances' antivirus engine.