Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability

On 18 September 2025, Fortra published a security advisory about a critical deserialization vulnerability in GoAnywhere MFT’s License Servlet, tracked as CVE-2025-10035 with a CVSS of 10.0. According to Microsoft Threat Intelligence, the flaw could allow a threat actor with a forged license response signature to deserialize attacker-controlled objects, potentially enabling command injection and remote code execution.

Exploitation activity observed in multiple organisations is attributed to a cybercriminal group tracked as Storm-1175, with related activity noted on 11 September 2025. The blog details a multi-stage campaign beginning with initial access via the GoAnywhere MFT deserialization, followed by persistence through abused remote monitoring and management tools such as SimpleHelp and MeshAgent, and the creation of .jsp files in GoAnywhere MFT directories.

Lateral movement involved commands like netscan, and C2 utilised RMM tools with a Cloudflare tunnel for secure communication; Rclone was seen during exfiltration, and Medusa ransomware was deployed in at least one environment. Microsoft urges customers to upgrade to the latest version per Fortra’s guidance and to implement comprehensive protection and monitoring as part of an overall defence.