Medusa Ransomware Actors Exploit Critical Fortra GoAnywhere Flaw

Threat actors armed with Medusa ransomware are actively exploiting a maximum-severity deserialization flaw in Fortra’s GoAnywhere MFT product (CVE-2025-10035), sparking further questions about the now well-known vulnerability. In a blog post on Monday, Microsoft Threat Intelligence warned that Storm-1175, a financially-motivated cybercrime group, was exploiting the GoAnywhere flaw in the wild, with Microsoft noting at least one environment where Medusa was deployed.

Fortra disclosed the vulnerability on 18 September, advising customers to upgrade to a patched version, after the flaw was found on 11 September in its advisory. Microsoft Defender researchers also observed exploitation activity on 11 September, according to the same Monday blog post, and Rapid7 researchers describe the exploitation as a zero-day given the private key requirement.

The GoAnywhere events have prompted talks about how a private key could be obtained or forged, and the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on 29 September.