Attack Chain

1. Attacker sends a specially crafted HTTP request to the CrushFTP server to bypass authentication (CVE-2025-31161).
2. The application processes the request, allowing the attacker to reach restricted administrative or system-level endpoints.
3. Attacker uses the established session to execute arbitrary commands through the CrushFTP command interface.
4. Command execution triggers the launch of 'mesch.exe' or executes arguments like 'b64exec' or 'fullinstall'.
5. The server process spawns the requested commands, which may include further script execution or malware deployment.
6. Attacker gains persistence or performs reconnaissance on the system.
7. Attacker proceeds to stage and execute the final payload, such as Hellcat ransomware, for exfiltration and extortion.

Impact

Successful exploitation allows remote attackers to bypass authentication and execute code with the privileges of the CrushFTP service. This can lead to total system compromise, data theft, and the deployment of ransomware. The vulnerability has been explicitly linked to Hellcat ransomware campaigns, which target organizations using CrushFTP for file transfer services.

Recommendation

1. Patch CrushFTP immediately by upgrading to the version that remediates CVE-2025-31161.
2. Enable ingestion of CrushFTP logs into your SIEM and deploy the detection rules below to identify exploitation attempts.
3. Review all CrushFTP server activity for the command patterns 'mesch.exe', 'b64exec', 'fullinstall', or 'run' in process or execution logs.
4. Isolate internet-facing CrushFTP servers or apply strict access controls to limit exposure to these services.
5. Investigate any instances where unauthorized users or suspicious IPs are observed executing system commands via the CrushFTP interface.