Storm-1175 Exploits GoAnywhere MFT Zero-Day (CVE-2025-10035) to Deploy Medusa Ransomware

Summary

A critical deserialization vulnerability (CVE-2025-10035) in Fortra’s GoAnywhere Managed File Transfer (MFT) has been actively exploited by the Storm-1175 threat actor group since September 2025. The flaw affects GoAnywhere MFT Admin Console versions up to 7.8.3 and allows attackers to bypass license-signature verification, inject malicious objects, and achieve remote code execution (RCE), resulting in complete system compromise.

The campaign culminated in the deployment of Medusa ransomware within multiple enterprise environments. The exploitation chain involved deserialization of untrusted data, abuse of remote monitoring tools, and data exfiltration using Rclone, highlighting Storm-1175’s operational sophistication and focus on financially motivated attacks.

Vulnerability Details

CVE-2025-10035 resides in the License Servlet of GoAnywhere MFT, enabling attackers to craft forged license-response signatures that bypass signature validation. This triggers unsafe deserialization, allowing the injection and execution of arbitrary commands on vulnerable systems.

• Affected Versions: GoAnywhere MFT Admin Console ≤ 7.8.3
• Impact: Full remote code execution (RCE) via crafted license responses
• CWE IDs: CWE-77 (Command Injection), CWE-502 (Deserialization of Untrusted Data)
• CPE: cpe:2.3:a:fortra:goanywhere_managed_file_transfer::::::::

Exploitation Timeline

• September 11, 2025: Suspicious activity detected; Fortra initiates investigation.
• September 12, 2025: Zero-day confirmed under active exploitation.
• September 15, 2025: Added to CISA KEV catalog.
• September 17, 2025: Patches under development.
• October 6, 2025: Official fixes released via versions 7.6.3 and 7.8.4; all MFTaaS instances upgraded.

Exploitation Chain

Storm-1175 gained initial access through the deserialization flaw, followed by persistence and lateral movement via SimpleHelp and MeshAgent RMM tools hidden beneath MFT processes. The attackers dropped .jsp web shells within GoAnywhere directories, enabling remote command execution.

Post-Compromise Activities:

• Discovery: Enumerated systems and network architecture using netscan.
• Lateral Movement: Utilized mstsc.exe for internal traversal.
• Command & Control: Established a Cloudflare tunnel to evade detection.
• Exfiltration: Used Rclone for data theft prior to Medusa ransomware deployment.

This campaign mirrors prior Cl0p ransomware operations from 2023 that abused CVE-2023-0669 in GoAnywhere MFT, indicating continued targeting of file transfer software ecosystems.

Recommendations

• Upgrade Immediately: Patch all instances of GoAnywhere MFT to the latest secure versions — v7.8.4 (current release) or v7.6.3 (sustain release). Ensure all MFTaaS instances are verified as updated.
• Restrict Admin Console Exposure: Remove GoAnywhere Admin Console from the public internet. Limit access to internal networks or enforce VPN-only connections to reduce the attack surface.
• Monitor Audit Logs: Review logs under userdata/logs/ for suspicious entries such as SignedObject.getObject or license parsing errors, potential indicators of deserialization exploitation.
• Enhance Network Segmentation: Isolate MFT servers from sensitive data stores and restrict outbound connections to prevent data exfiltration.
• Implement Security Hardening: Use application firewalls, proxy controls, and endpoint monitoring to detect exploitation attempts and unauthorized RMM tool installations.

Indicators of Compromise (IoCs)

SHA256 Hashes:

• 4106c35ff46bb6f2f4a42d63a2b8a619f1e1df72414122ddf6fd1b1a644b3220
• c7e2632702d0e22598b90ea226d3cde4830455d9232bd8b33ebcb13827e99bc3
• cd5aa589873d777c6e919c4438afe8bceccad6bbe57739e2ccb70b39aee1e8b3
• 5ba7de7d5115789b952d9b1c6cff440c9128f438de933ff9044a68fff8496d19

IPv4 Addresses:

• 31[.]220[.]45[.]120
• 45[.]11[.]183[.]123

• 213[.]183[.]63[.]41

MITRE ATT&CK TTPs

References

• Fortra Security Advisory – FI-2025-012
• Fortra Blog – CVE-2025-10035 Investigation Summary
• Microsoft Security Blog – Investigating Active Exploitation of CVE-2025-10035
• Hive Pro – Cl0p Ransomware Group Claims Responsibility for GoAnywhere Attacks

• MITRE ATT&CK Framework