CVE-2025-31161Vulnerability

1. “KillSec has also been linked to at least one zero-day—CVE-2025-31161 in CrushFTP—but has been recently going under the radar, compared to more famous groups like Qilin, DragonForce, or Akira.”

   Risky Business NewsNews2 Oct 2026
   Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe

2. “On 4 April 2025, the CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation blog was published, and on 14 April 2025, the CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited in the Wild blog was published.”

   HuntressVendor6 May 2025
   Do Tigers Really Change Their Stripes?

3. “… tradecraft with these discovery commands and a cluster of activity exploiting the recent CrushFTP vulnerability in our recent blog: CVE-2025-31161 Auth Bypass and Post-Exploitation.”

   HuntressVendor14 Apr 2025
   CVE-2025-30406: Gladinet CentreStack & Triofox Exploited

4. “CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation”

   HuntressVendor4 Apr 2025
   CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation

• 2.58.56[.]16in 3 reports
• rtb.mftadsrvr[.]comin 2 reports
• 196.251.85[.]31in 1 report
• hxxps://gladinetsupport.s3.us-east-1.amazonaws[.]com/gladinet/securityadvisory-cve-2005.pdfin 1 report
• gladinetsupport.s3.us-east-1.amazonaws[.]comin 1 report
• hxxps://gladinetsupport.s3.us-east-1.amazonaws[.]com/gladinet/securityadvisory-cve-2025-triofox.pdfin 1 report
• hxxp://redacted.oastify[.]com/REDACTEDin 1 report
• redacted.oastify[.]comin 1 report
• hxxp://redacted.oast[.]funin 1 report
• redacted.oast[.]funin 1 report
• 104.21.16[.]1in 1 report
• 104.21.48[.]1in 1 report
• 48b006cb17e75ecd…abca1c5fabbfin 1 report
• 30981d4082b58704…26aef21e75c2in 1 report
• 165.227.7[.]206in 1 report
• 45.84.107[.]76in 1 report
• 172.235.144[.]67in 1 report
• 114c196c39c91575880a5012d06565b1in 1 report

Also named with it: CVE-2025-30406, CVE-2025-2825