Microsoft Links Storm-1175 to GoAnywhere Exploit Deploying Medusa Ransomware

Microsoft says it has linked the Storm-1175 threat actor to the exploitation of a critical deserialization flaw in Fortra GoAnywhere software that enables command injection and potentially remote code execution, using it to deploy Medusa ransomware. According to Microsoft Threat Intelligence, the vulnerability CVE-2025-10035 (CVSS 10.0) was addressed in GoAnywhere version 7.8.4, or Sustain Release 7.6.3, and requires a forged license response signature for exploitation.

Storm-1175 is described as a cybercriminal group known for deploying Medusa ransomware and targeting public‑facing applications for initial access since 11 September 2025, with watchTowr noting indications of active exploitation since at least 10 September.

The attackers’ operation reportedly drops remote monitoring and management tools such as SimpleHelp and MeshAgent to maintain persistence, creates .jsp files in GoAnywhere MFT directories, and uses mstsc.exe for lateral movement, with a Cloudflare tunnel and Rclone observed for data exfiltration in at least one victim environment. The attack chain ultimately facilitates Medusa ransomware deployment and broader access within networks.