Cybersecurity Alert - Threat Actors Exploiting Gladinet CentreStack and TrioFox Vulnerabilities

Impact: All Firms Using Gladinet CentreStack or TrioFox Applications

FINRA firms should be aware of multiple critical vulnerabilities in Gladinet’s CentreStack or TrioFox file sharing and collaboration software applications, which threat actors are actively exploiting to gain unauthorized access and remote control of organizational systems. 

FINRA recommends sharing this Cyber Alert with appropriate information technology and information security personnel—as well as any third-party vendors that may use this Gladinet applications—to identify whether your firm is impacted and take immediate steps to protect your environments.

BACKGROUND

Gladinet is a technology company that specializes in cloud storage and file management solutions. In response to evidence that threat actors have actively been exploiting weak data encryption protocols1 in these applications, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-14611 to its Known Exploited Vulnerabilities (KEV) Catalog on Dec. 15, 2025. This critical insecure cryptography vulnerability affects Gladinet CentreStack and TrioFox products prior to version 16.12.10420.56791.

Threat actors—including the known ransomware group Clop2—are confirmed to have already exploited these vulnerabilities to gain access to organizations’ systems, with many of these attacks coming from the same IP address (147.124.216[.]205). These threat actors have expanded their attacks by exploiting two additional vulnerabilities (CVE-2025-11371 and CVE-2025-30406) to bypass authentication controls, execute malicious code, and steal data on the target server. 

If your firm uses Gladinet CentreStack or TrioFox for file sharing or collaboration, these vulnerabilities could allow unauthorized access and control of systems and data, and ongoing unauthorized access to your environment. 

RECOMMENDED ACTIONS

FINRA strongly encourages member firms using Gladinet CentreStack or TrioFox to immediately share the following information with their cybersecurity and technology management personnel so they can take urgent steps to protect their environments. Firms should consult the hyperlinks contained in the Technical Details section below for specific instructions on updating vulnerable systems, and consider the following actions to mitigate the risk associated with this vulnerability:

  1. Patching/Upgrading:3 Because threat actors are currently exploiting this vulnerability, the most direct and critical mitigation is to immediately update all Gladinet CentreStack and TrioFox deployments to version 16.12.10420.56791 or newer. Always first test patches in a non-production environment (see Technical Details section below CVE-2025-11371, CVE-2025-30406 and CVE-2025-14611 for additional information).
  2. Rotate Machine Keys:4 After updating, immediately rotate (change) the machine Key in the server's web.config file. This critical step invalidates any malicious ViewState payloads an attacker may have generated using previously compromised keys.
  3. Network Segmentation & Access Control:5 If possible, block the reported threat actor IP address 147.124.216[.]205 at the network perimeter (firewall/WAF), although attackers may quickly switch sources. Implement network segmentation and access controls to limit the blast radius in case of compromise. Restrict access to vulnerable services to only necessary users and IP ranges.
  4. Scan for Indicators of Compromise (IoCs):6 Review IIS logs and application event logs for signs of compromise. Specifically search for the encrypted string vghpI7EToZUDIZDdprSubL3mTZ2 in GET requests to /storage/filesvr.dn. This string represents the encrypted path to the sensitive web.config file and indicates potential exploitation.
  5. Check for Persistence/Backdoors:7 Thoroughly inspect compromised or potentially compromised host systems for unauthorized files, new user accounts, or persistent access mechanisms (e.g., scheduled tasks, modified web application files, registry changes) that may have been established by attackers after achieving remote code execution.
  6. Review Application Pool Identity:8 Validate that the IIS Application Pool Identity under which CentreStack/TrioFox runs has the principle of least privilege applied, limiting its ability to perform high-privilege system actions if RCE is achieved.

Technical Details

  • CVE-2025-11371 (CVSS: 7.5, EPSS: 66.0%, In KEV: Yes 11/4/2025):9 In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and TrioFox: All versions prior to and including 16.7.10368.56560.
     
  • CVE-2025-14611 (CVSS: 7.1, EPSS: 37.83%, In KEV: Yes): A vulnerability that uses hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
     
  • CVE-2025-30406 (CVSS: 9.8, EPSS: 86.8%, In KEV: Yes): A vulnerability caused due to CentreStack portal’s hardcoded machinekey use. Enables threat actors to serialize a payload server-side deserialization to achieve RCE.  

FINRA encourages member firms that identify data breaches or attempted data breaches to contact your Risk Monitoring Analyst and report them to: 

Additionally, both the FBI and the Cybersecurity & Infrastructure Security Agency (CISA) urge organizations to promptly report cyber incidents to a local FBI Field Office or the FBI Internet Crime Complaint Center (IC3) at IC3.gov, and to CISA via CISA’s 24/7 Operations Center ([email protected] or 888-282-0870). 

Questions related to this Alert or other cybersecurity-related topics can be emailed to the FINRA Cyber and Analytics Unit (CAU). 

Note: In citing any industry publication, FINRA is not adopting any author’s viewpoint or endorsing any commercial product or service. Any reference in cited articles to specific commercial products, processes or services does not constitute or imply their endorsement, recommendation or favoring by FINRA. This Alert does not create new legal or regulatory requirements or new interpretations of existing requirements, nor does it relieve firms of any existing obligations under federal securities laws, regulations, and FINRA rules. Member firms may consider the information in this Alert in developing new, or modifying existing, policies and procedures that are reasonably designed to achieve compliance with relevant regulatory obligations based on the member firm’s size and business model. Moreover, some information may not be relevant due to certain firms’ business models, sizes, or practices.

If you would like to add or change who receives this email, please update your firm’s Chief Information Security Officer (CISO), Chief Compliance Officer (CCO), Chief Risk Officer (CRO) and/or Regulatory Inquiries contact in FINRA Gateway.

1 Specifically, threat actors are exploiting weak cryptography controls because of the use of hardcoded cryptographic keys and initialization vectors that are identical across all vulnerable installations of the applications. 

2 Clop (aka cl0p) is a ransomware gang that operates flexibly as a Ransomware as a Service (RaaS) platform, an affiliate for others, and an Initial Access Broker (IAB). Initially known for encrypting and leaking data, Clop shifted its focus primarily to large-scale data theft around 2021.

3 If immediate patching is not possible, limit internet exposure of endpoints, require authentication for sensitive endpoints, temporarily segment affected services, and apply rate limiting with anomaly detection around endpoints to reduce exposure to high-volume automated exploitation.

4 This recommendation follows one category of the IDENTIFY (ID) core function of NIST's Cybersecurity Framework (CSF) 2.0: ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.

5 This recommendation follows one category of the PROTECT (PR) core function of NIST's Cybersecurity Framework (CSF) 2.0: PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.

6 This recommendation follows one category of the PROTECT (PR) core function of NIST's Cybersecurity Framework (CSF) 2.0: PR.IR-01: Networks and environments are protected from unauthorized logical access and usage.

7 This recommendation follows one category of the PROTECT (PR) core function of NIST's Cybersecurity Framework (CSF) 2.0: PR.PS-01: Configuration management practices are established and applied. 

8 This recommendation follows one category of the DETECT (DE) core function of NIST's Cybersecurity Framework (CSF) 2.0: DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.

9 Commonly used cybersecurity definitions and resources: (1) Common Vulnerabilities and Exposures (CVE) – A NIST dictionary of publicly known cybersecurity vulnerabilities, each assigned a unique, standardized identifier (CVE ID) to facilitate sharing and communication about the specific security flaw; (2) Common Vulnerability Scoring System (CVSS) – Measures the relative severity of software flaw vulnerabilities ranging from 0 to 10, with 10 being the most severe; (3) Exploit Prediction Scoring System (EPSS) – Provides probabilities that a vulnerability will be observed to be exploited “in the wild” within the next 30 days (e.g., a score of 0.5 indicates a 50 percent chance that firms using the tool will be exploited through it in the next 30 days); and (4) Known Exploited Vulnerabilities (KEV) – CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild (organizations often use the KEV catalog as an input to their vulnerability management prioritization framework).