Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks

The Medusa ransomware operators exploited the GoAnywhere MFT vulnerability one week before patches were released, according to SecurityWeek. The flaw, tracked as CVE-2025-10035 with a CVSS score of 10/10, was disclosed on 18 September when Fortra rolled out patches for it.

According to Microsoft, Storm-1175, a financially‑motivated hacking group based in China and known for using the Medusa ransomware, has been exploiting the vulnerability since 11 September, targeting internet-facing GoAnywhere MFT instances with forged license response signatures to achieve remote code execution.

The attackers deployed the SimpleHelp and MeshAgent remote monitoring tools under the GoAnywhere MFT process, created a .jsp file in the application’s directory, and conducted discovery, lateral movement, and data exfiltration using tools such as mstsc.exe and Rclone, with the Medusa ransomware deployed on at least one network. Nearly three weeks after patches, and a week after the KEV listing, Fortra had not updated its advisory to warn of exploitation, a point raised by watchdogs.