Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability

Summary

Threat actors are actively exploiting weak cryptography in Gladinet CentreStack and Triofox. The chain leverages hard-coded AES keys to retrieve the web.config file and then pivots to ViewState deserialization attacks. In two incidents observed on December 15, PowerShell delivered via the IIS worker process was used to download and execute a malicious binary named conqueror.exe. The activity is potentially linked to the cl0p ransomware group.

Investigation

Huntress recorded PowerShell spawned by w3wp.exe that invoked a base64-encoded payload to fetch conqueror.exe from 185.196.11.207. The executable was saved to C:UsersPublicconqueror.exe and run for host enumeration. Follow-on behavior included a curl request to the same server and use of quser.exe to list active sessions. Event ID 1316 also captured exploitation attempts from 146.70.134.50 associated with CVE-2025-30406.

Mitigation

Gladinet released version 16.12.10420.56791, rotating static cryptographic keys and patching the ViewState deserialization weakness. Organizations should upgrade promptly and rotate existing machineKey values to invalidate prior exposure. Review web logs for the encrypted query string “vghpI7EToZUDIZDdprSubL3mTZ2” to identify probing or exploitation. Further reduce risk by disabling unnecessary IIS handlers and enforcing strict input validation.

Response

Alert on PowerShell with base64 payloads originating from w3wp.exe and on creation or execution of C:UsersPublicconqueror.exe. Isolate affected hosts, preserve IIS and endpoint telemetry, and block outbound traffic to the malicious IPs and URLs cited. Verify web.config integrity, rotate machine keys immediately, and conduct a forensic review of all CentreStack/Triofox systems to scope impact and remove artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  An attacker, having identified the Gladinet CentreStack instance, crafts an encrypted payload that conforms to the vulnerable query format. Using a legitimate web client (e.g., curl or PowerShell Invoke-WebRequest), the attacker issues a GET request to the hidden endpoint /storage/filesvr.dn with the encrypted token that, when decrypted by the server, resolves to a request for web.config. The request is indistinguishable from normal traffic at the protocol level, but the unique ciphertext pattern is captured by the detection rule.

• Regression Test Script:

  #!/usr/bin/env bash
  # ------------------------------------------------------------
  # Simulate Encrypted GET request for Gladinet CentreStack web.config
  # ------------------------------------------------------------
  
  # Target server (replace with actual hostname/IP)
  TARGET="http://target-server.example.com"
  
  # One of the known encrypted payloads from the rule (example)
  ENCRYPTED_PAYLOAD="/storage/filesvr.dn t=vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m:ZDplEYEsO5ksZajiXcsumkDyUgpV5VLxL%7C372varAu"
  
  # Issue the request
  curl -s -o /dev/null -w "%{http_code}n" "${TARGET}${ENCRYPTED_PAYLOAD}"
  # ------------------------------------------------------------

• Cleanup Commands:

  # No persistent changes were made to the target; only network traffic was generated.
  # If a temporary firewall rule or network capture was started for the test, remove it:
  
  # Example: stop tcpdump (Linux) or remove WinPcap filter (Windows)
  # sudo pkill -f tcpdump