Huntress Details CrushFTP CVE-2025-31161 Exploitation and Post-Exploitation Activity
Summary
Huntress observed in-the-wild exploitation of CrushFTP’s CVE-2025-31161 authentication bypass, followed by backdoor-account creation and deployment of RMM tools and malware. Affects versions 10.0.0–10.8.3 and 11.0.0–11.3.0; patched in 10.8.4+ and 11.3.1+.
Key points
- The vulnerability allows unauthenticated HTTP requests to impersonate a known CrushFTP user and potentially gain administrator-level access.
- Huntress observed exploitation across five hosts at five companies; it said the broader impact remained unknown.
- Observed post-exploitation included creating backdoor accounts and installing MeshAgent, AnyDesk, and SimpleHelp for continued access.
- On one host, an attacker attempted to dump SAM and System registry hives to harvest credentials.
- Huntress found a large DLL implementing the TgBot library, but did not observe its execution and could not determine its purpose; the bot token was not recovered.
- CrushFTP versions 10.0.0–10.8.3 and 11.0.0–11.3.0 are affected; the article says versions 10.8.4+ and 11.3.1+ are patched.
Article Details
- Attack Vectors
- Exploitation of CVE-2025-31161 in exposed CrushFTP instances allowed unauthenticated attackers to impersonate users and obtain administrator-level access.
- Attackers used the access to create backdoor accounts, upload files, and install remote monitoring and management software, including MeshAgent, AnyDesk, and SimpleHelp.
- One intrusion involved dumping the SAM and System registry hives to harvest credentials.
- A threat actor attempted to evade Defender by adding C:\Windows to its exclusion list and used Cloudflare Tunnel to establish persistent access.
- Defensive Notes
- Update CrushFTP to version 11.3.1 or later, or 10.8.4 or later; Huntress confirmed the authentication bypass is prevented in patched versions.
- Review CrushFTP.log and logs/session_logs for suspicious authentication-bypass activity, account creation, and file uploads; distinguish the bypass-related AWS4-HMAC-SHA256 Credential=crushadmin/ string from legitimate sessions using currentAuth.
- Hunt for unexpected child processes launched by CrushFTPService.exe, unauthorized accounts, and unexpected MeshAgent, AnyDesk, or SimpleHelp installations.
- Investigate suspicious Defender exclusion changes, registry-hive access, and Cloudflare Tunnel activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 143[.]244[.]47[.]67 | Attacker IP address observed deleting storm.exe and uploading mx.exe. |
| IPV4 | 146[.]70[.]166[.]201 | Attacker IP address observed uploading storm.exe. |
| IPV4 | 172[.]235[.]144[.]67 | Attacker IP address observed during the CrushFTP exploitation and backdoor-account activity. |
| IPV4 | 2[.]58[.]56[.]16 | Attacker IP address observed uploading the MeshAgent installer through CrushFTP. |
| MD5 | 114c196c39c91575880a5012d06565b1 | MD5 hash reported for the MeshAgent installer uploaded as mesch.exe. |
| MD5 | 1ab5a915e306686a1c7bebd03563a977 | MD5 hash of the d3d11.dll file uploaded during the intrusion; the article identifies it as a malicious DLL. |
| SHA256 | 0b8e76eb315bc522af3cec74749a85e8f55cfed720976892d6610cfc89d84f69 | SHA-256 hash of the modified SimpleHelp installer identified as mx.exe. |
| SHA256 | 9036c92c3ca73cb6ec2da25035322554319288fd2f6db906413011873ad7e281 | SHA-256 hash of the MeshAgent installer binary identified in the IOC list. |
| SHA256 | be6cb5f80b33b9e97622d278a86a99e67b78ccab0b3e554b8430ae5969bcfc0e | SHA-256 hash listed for the TgBot DLL uploaded during the intrusion. |
| SHA256 | ee6d24410a8cf31d672d2a47466b76ad287c7ba016d3711490f0f607b1dc0be3 | SHA-256 hash of the modified SimpleHelp installer identified as storm.exe. |
| URL | hxxps[:]//1212[.]requestcatcher[.]com/ | Webhook endpoint used by a threat actor to send host group-enumeration output. |
MITRE ATT&CK
T1003.002 · Security Account ManagerOn one host, the attacker dumped the SAM and System registry hives to harvest credentials.T1059.001 · PowerShellPowerShell commands were used to send group-enumeration output to a webhook and modify Defender exclusions.T1059.003 · Windows Command Shellcmd.exe commands were used to install AnyDesk and create a user account.T1069.001 · Local GroupsThe attacker ran whoami /groups to enumerate group membership on a compromised host.T1105 · Ingress Tool TransferAttackers uploaded MeshAgent, a DLL, and SimpleHelp installer files to compromised hosts through CrushFTP.T1136 · Create AccountAttackers created backdoor accounts in CrushFTP and on a compromised host.T1190 · Exploit Public-Facing ApplicationAttackers exploited the authentication bypass in exposed CrushFTP instances to gain access.T1219 · Remote Access ToolsAttackers installed MeshAgent, AnyDesk, and SimpleHelp for remote access and persistence.T1562.001 · Disable or Modify ToolsThe attacker attempted to evade Defender by adding C:\Windows to its exclusion list.
CVE
Vendors
Products
Cloudflare TunnelFinally, the threat actor installed a Cloudflare Tunnel to set the stage for persistent access:CrushFTPCrushFTP CVE-2025-31161 Auth Bypass and Post-ExploitationDefenderWhen mx.exe was uploaded, Defender initially quarantined the executable.MeshCentralWe uncovered further post-exploitation activity leveraging the MeshCentral agent and other malware that we will discuss in this writeup.