US EditionMicrosoft Warns Critical GoAnywhere Security Bug Is Being Exploited by Ransomware Gang, so Be on Your Guard
Storm-1175 has exploited a critical zero-day flaw in GoAnywhere MFT since early September, enabling remote code execution and wide Medusa ransomware deployment, Microsoft confirmed.
7 Articles
7 Articles
Attackers Deployed Medusa Ransomware Via GoAnywhere Zero-Day
Cybercriminals exploited a critical deserialization flaw in Fortra’s GoAnywhere Managed File Transfer (MFT) tool—tracked as CVE-2025-10035—to drop Medusa ransomware, Microsoft disclosed Monday. The campaign, attributed to a group Microsoft tracks as Storm-1175, illustrates how file-transfer infrastructure once again becomes a staging ground for high-impact attacks. According to Microsoft, Storm-1175 used the vulnerability to gain initial access …
Microsoft has tracked the threat group Storm-1175 as exploiting the critical vulnerability CVE-2025-10035 (CVSS score: 10.0) in Fortra GoAnywhere software to deploy the Medusa ransomware. This vulnerability could lead to command injection and remote code execution. The attackers exploited this vulnerability to gain system and user discovery, maintain access, and deploy tools for lateral movement and malware distribution. Microsoft confirmed that…
Microsoft Links Storm-1175 to GoAnywhere Exploit Deploying Medusa Ransomware
Microsoft on Monday attributed a threat actor it tracks as Storm-1175 to the exploitation of a critical security flaw in Fortra GoAnywhere software to facilitate the deployment of Medusa ransomware. The vulnerability is CVE-2025-10035 (CVSS score: 10.0), a critical deserialization bug that could result in command injection without authentication. It was addressed in version 7.8.4, or the Sustain
GoAnywhere 0-Day RCE Actively Exploited to Deliver Medusa Ransomware - Cybernoz - Cybersecurity News
A critical zero-day vulnerability in GoAnywhere MFT’s License Servlet is being actively exploited to deploy Medusa ransomware. On September 18, 2025, Fortra released an advisory disclosing CVE-2025-10035, a deserialization flaw with a perfect CVSS score of 10.0. Threat actors tracked as Storm-1175 have abused this issue to gain remote code execution (RCE) on exposed systems, leading to widespread compromise. Vulnerability Analysis CVE-2025-10035…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
