GoAnywhere Zero-Day Exploitation by Medusa Ransomware
An urgent overview of the active zero-day exploitation of a critical vulnerability, CVE-2025-10035, in Fortra’s GoAnywhere MFT platform by the cybercrime group Storm-1175, which is affiliated with the Medusa ransomware operation. This flaw, a deserialization weakness, allows remote attackers easy access to corporate networks, enabling the threat actors to establish persistence using legitimate remote monitoring tools, conduct comprehensive network reconnaissance, and ultimately exfiltrate data before deploying Medusa ransomware payloads. Furthermore, the text outlines crucial mitigation and defense strategies, including immediate patching and comprehensive security measures, and introduces Technijian, an IT services provider offering solutions to help organizations secure their infrastructures against such sophisticated threats.
