Tag: meshcentral

4 Attack Reports | 0 Vulnerabilities

Attack reports

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

A critical vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox software has been discovered and is being actively exploited. The flaw involves hardcoded cryptographic keys in configuration files, allowing attackers to abuse ASPX ViewState for remote code execution. Affected versions …

privilege escalation

remote code execution

Published: April 15, 2025

Linked vulnerabilities : CVE-2025-30406

Downloadable IOCs: 6

CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation

A critical vulnerability (CVE-2025-31161) in CrushFTP managed file transfer software allows attackers to bypass authentication and gain admin-level access. Affecting versions 10.0.0-10.8.3 and 11.0.0-11.3.0, the flaw enables unauthorized actions, including data retrieval and administrative control.…

authentication bypass

meshcentral agent

Published: April 5, 2025

Downloadable IOCs: 0

Analyzing the Awaken Likho APT group implant: new tools and techniques

A new campaign by the Awaken Likho APT group targeting Russian government agencies and industrial enterprises was discovered in June 2024. The group has significantly changed its attack methods, now preferring the MeshCentral platform agent instead of UltraVNC for remote access. The implant is deli…

Published: October 7, 2024

Downloadable IOCs: 0

Infrastructure linking PandorahVNC and Mesh Central

This analysis investigates PandorahVNC, a sophisticated Hidden Virtual Network Computing tool, and its connections to a new service called AnonVNC. The report explores the online presence of the tool's creator, known as 'All_father', and examines the infrastructure used for both PandorahVNC and Ano…

Published: September 27, 2024

Downloadable IOCs: 11

Click here to see more Attack Reports