Loading threat actor…
UNC6485 is a threat cluster tracked by Google Threat Intelligence Group for active exploitation of Gladinet Triofox vulnerabilities in 2025, most notably CVE-2025-12480. The cluster was observed exploiting the flaw as early as August 24, 2025 by abusing HTTP Host header handling to bypass authentication, regain access to Triofox setup and configuration pages, create a new native administrative account, and then chain that access with misuse of Triofox’s built-in anti-virus feature to achieve arbitrary code execution with SYSTEM privileges. Post-compromise activity attributed to UNC6485 included uploading and executing attacker-controlled scripts, deploying legitimate remote administration software for persistent access, establishing SSH reverse tunnels to enable remote desktop access, and conducting follow-on hands-on-keyboard operations. Observed actions included account creation, attempted password changes, attempted addition of accounts to privileged groups, enumeration of SMB sessions and user information, staging of tools in temporary directories, and use of renamed tunneling and administration utilities for defense evasion and remote access. The cluster’s observed tradecraft demonstrates strong capability in initial access via exploitation of internet-facing enterprise software, persistence through newly created administrator accounts and remote access tooling, privilege escalation through SYSTEM-level execution and attempted administrative group changes, reconnaissance of local and domain environments, and post-exploitation activity consistent with preparation for broader network access. Publicly available reporting directly ties UNC6485 to exploitation of Triofox, but does not provide high-confidence attribution to a specific country, broader campaign lineage, or a confirmed ransomware or espionage program.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
UNC6485 exploited a zero-day vulnerability (CVE-2025-12480) in Gladinet Triofox to achieve unauthenticated remote code execution, leveraging a complex attack chain involving authentication bypass, rogue database setup, admin account creation, file upload, and abuse of antivirus configuration for code execution.
UNC6485 is a threat cluster known for exploiting improper access control vulnerabilities in enterprise file-sharing platforms such as Gladinet Triofox.
UNC6485 is actively exploiting CVE-2025-12480, an improper access control vulnerability in Gladinet Triofox, to gain SYSTEM-level access, establish persistence, deploy remote access tools, steal data, and potentially move laterally within customer networks.
UNC6485 is known for exploiting CVE-2025-12480, an improper access control vulnerability in Gladinet Triofox.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.