GoAnywhere MFT zero-day used by Storm-1175 in Medusa ransomware campaigns

GoAnywhere MFT has a zero-day flaw (CVE-2025-10035) that Storm-1175 has been exploiting in Medusa ransomware campaigns, with active in-the-wild activity dating back to 10 September 2025 and follow-up confirmations from Fortra’s advisory dated 18 September 2025.

The deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT allows an actor with a forged license response signature to deserialize an arbitrary object, enabling potential command injection and remote code execution without user interaction.

Microsoft Defender observed activity matching Storm-1175 TTPs, and the group gained access via the zero-day, maintaining persistence by abusing RMM tools such as SimpleHelp and MeshAgent, using Netscan for reconnaissance and mstsc.exe for lateral movement, before exfiltrating data with Rclone and deploying Medusa ransomware.

Fortra advises patching GoAnywhere MFT and defenders are urged to update and implement measures such as Defender EASM, full automated investigation and remediation, and aggressive blocking of suspicious activity and web shells. The threat actor set up Cloudflare tunnels for secure command-and-control communications as part of the operation. According to Microsoft, one compromised environment saw successful deployment of Medusa.