Hackers abuse Triofox antivirus feature to deploy remote access tools
Source Reddit InfoSec News
Description
Hackers have been observed abusing a feature within the Triofox antivirus solution to deploy remote access tools (RATs). This abuse enables attackers to bypass traditional security controls by leveraging trusted antivirus functionality to execute malicious payloads remotely. Although no known exploits are currently active in the wild, the technique represents a high-severity threat due to the potential for unauthorized remote access and control over affected systems. European organizations using Triofox antivirus are at risk of targeted attacks that could compromise confidentiality, integrity, and availability of critical assets. The threat requires immediate attention to monitor and restrict misuse of antivirus features. Mitigation involves strict application control policies, enhanced monitoring of antivirus behavior, and network segmentation to limit lateral movement. Countries with higher adoption of Triofox or strategic sectors relying on this antivirus are more likely to be impacted. Given the ease of exploitation through trusted software features and the high potential impact, this threat is assessed as high severity. Defenders should prioritize detection of anomalous antivirus activity and prepare incident response plans accordingly.