Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability

**Executive summary:** Huntress discloses a critical weakness in Gladinet CentreStack and Triofox where hardcoded AES-derived keys let attackers decrypt/forge access tickets to access web.config (including machineKey), enabling ViewState deserialization and potential RCE; the issue (CVE-2025-14611) has been observed exploited against at least nine organizations with payload downloads (conqueror.exe), associated IoCs and recommended upgrades/mitigations.