Hackers exploit Gladinet CentreStack cryptographic flaw in RCE attacks

Hackers are actively exploiting an undocumented cryptographic flaw in Gladinet CentreStack and Triofox where hardcoded AES keys and IVs in GladCtrl64.dll allow attackers to decrypt or forge Access Tickets; forged tickets were used to retrieve web.config and the machineKey, enabling ViewState deserialization remote code execution. Huntress observed exploitation against at least nine organizations, Gladinet released patches and IoCs, and defenders are advised to update, rotate machine keys, and scan for the provided indicators.