Full Report
Across the larger cybersecurity community, an often-used adage is that “threat actors always change their tactics.” However, when we really start to look at and track incident data, we begin to see that while some changes may be necessitated based on infrastructures and other challenges the threat actor may encounter, there are times when tactics remain consistent across incidents. Recent investigations into exploitation activity for CVE-2025-31151 and CVE-2025-30406 show similar TTPs across different incidents.
Analysis Summary
# Tool/Technique: Post-Exploitation Persistence via Mesh Agent and TgBot
## Overview
This entry covers a consistent set of TTPs (Tactics, Techniques, and Procedures) observed in early 2025 across multiple exploitation campaigns. Despite targeting different software (CrushFTP and Gladinet CentreStack/Triofox), the threat actor utilized a standardized post-exploitation toolkit consisting of an open-source Remote Monitoring and Management (RMM) tool for persistence and a Telegram-based bot for command and control.
## Technical Details
- **Type:** Malware (TgBot implementation) & legitimate Tool (Mesh Agent RMM)
- **Platform:** Windows
- **Capabilities:** Remote Access, File Transfer, C2 via Telegram API, Persistence.
- **First Seen:** April 2025
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- T1190 - Exploit Public-Facing Application (CVE-2025-31161, CVE-2025-30406)
- **[TA0003 - Persistence]**
- T1219 - Remote Access Software (Mesh Agent)
- **[TA0011 - Command and Control]**
- T1102.002 - Web Service: Bidirectional Communication (Telegram API via TgBot)
- T1573.002 - Encrypted Channel: Asymmetric Cryptography (HTTPS for Mesh Agent)
## Functionality
### Core Capabilities
- **RMM Persistence:** Installation of Mesh Agent (renamed as `mesch.exe`) to provide a stable, "living-off-the-land" style remote access channel that often bypasses traditional security alerts.
- **Telegram C2:** Use of `d3d11.dll`, which is a custom implementation of the open-source **TgBot** (C++ Telegram bot library), allowing the actor to receive instructions and send data via the Telegram API.
### Advanced Features
- **Exploit Versatility:** The actor demonstrates the ability to pivot their delivery method depending on the target environment (e.g., using MFT logs in CrushFTP vs. IIS logs in CentreStack) while maintaining identical post-exploitation payloads.
## Indicators of Compromise
- **File Hashes (SHA256):**
- *(Specific hashes not provided in the snippet, but referenced as quarantined by Defender)*
- **File Names:**
- `d3d11.dll` (TgBot/Malicious DLL)
- `mesch.exe` (Mesh Agent Installer)
- **Network Indicators:**
- `2.58.56[.]16` (Attacker-controlled IP used for initial access and file delivery)
- `hxxps[://]rtb[.]mftadsrvr[.]com:2087` (Mesh Agent C2 Server)
- **Behavioral Indicators:**
- Execution of installers from `C:\Windows\Temp`.
- Unauthorized installation of RMM tools in environments where MeshCentral is not used.
- Unexpected outbound connections to Telegram API endpoints from server processes.
## Associated Threat Actors
- **Status:** Unnamed/Tracked via TTPs. The consistency in infrastructure (`2.58.56[.]16`) and tooling suggests a single organized group or affiliate.
## Detection Methods
- **Signature-based:** Windows Defender identifies the `d3d11.dll` (TgBot) and quarantines it.
- **Behavioral detection:** Monitor for web server processes (IIS, CrushFTP) spawning command shells or downloading executable files to temporary directories.
- **Log Analysis:** Scrutinize application logs for unauthorized file transfers and connections from known malicious IPs like `2.58.56[.]16`.
## Mitigation Strategies
- **Patch Management:** Immediately apply security updates for **CVE-2025-31161** (CrushFTP) and **CVE-2025-30406** (CentreStack/Triofox).
- **Application Whitelisting:** Prevent the execution of unauthorized RMM tools (Mesh Agent, AnyDesk, etc.) within the enterprise.
- **Network Segmentation:** Restrict outbound internet access from sensitive servers to only necessary ports and sanctioned domains.
## Related Tools/Techniques
- **MeshCentral:** The open-source management server used to control Mesh Agents.
- **TgBot-cpp:** The legitimate open-source library leveraged by the actor for the `d3d11.dll` malware.