CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

**Huntress observed active exploitation of CVE-2025-30406 in Gladinet CentreStack/Triofox servers (hardcoded machineKey enabling ViewState deserialization and RCE), documented multiple compromises across partner organizations, provided IOCs (malicious DLLs, renamed launcher/Centre.exe, attacker IPs), described post-exploitation activity (Cobalt Strike, MeshCentral, lateral movement), and supplied detection and mitigation guidance including patched versions and PowerShell remediation scripts.**