CVE-2025-32975: The Open Directory Behind the KACE SMA Breach and 60+ Downstream Victims

**Executive summary:** Hunt.io captured an exposed C2 directory (216.126.225.156:8000) containing a complete post‑exploitation toolkit and a MariaDB dump from a compromised Quest KACE SMA appliance exploited via CVE-2025-32975; the breach confirmed active exploitation, exposed HIQ and 60+ client organizations across sensitive sectors, and included detailed IOCs, tooling analysis, MITRE mappings, and remediation guidance.