GoAnywhere 0-Day RCE Vulnerability Exploited in the Wild to Deploy Medusa Ransomware
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical deserialization flaw in GoAnywhere<\/a> MFT\u2019s License Servlet, tracked as CVE-2025-10035<\/a>, has already been weaponized by the Storm-1175 group to execute the Medusa ransomware.<\/p>\n The vulnerability affects GoAnywhere MFT versions up to 7.8.3. It resides in the License Servlet Admin Console, where a threat actor can forge a license response signature and bypass validation checks.<\/p>\n By deserializing an attacker-controlled object, the actor gains the ability to inject arbitrary commands into the Java process, ultimately leading to full remote code execution on internet-exposed instances.<\/p>\n The flaw does not require authentication<\/a> once a validly signed payload is crafted or intercepted, making exploitation trivially achievable against unpatched systems.\u00a0<\/p>\n Successful attacks allow system and user enumeration, long-term persistence, and deployment of additional tools to facilitate lateral movement and data exfiltration.\u00a0<\/p>\n Immediate patching is paramount; administrators must upgrade to the versions specified in Fortra\u2019s advisory to remediate the issue and audit any potentially compromised environments.<\/p>\n Microsoft Threat Intelligence has attributed<\/a> active exploitation to Storm-1175, a ransomware group notorious for targeting public-facing applications.\u00a0<\/p>\n Initial access is gained through the newly disclosed deserialization bug in GoAnywhere MFT.\u00a0<\/p>\n After seizing control,\u00a0Storm-1175<\/a>\u00a0drops RMM binaries, specifically MeshAgent and SimpleHelp, into the GoAnywhere service directory.<\/span> Concurrently, malicious JSP web shells are created to facilitate stealthy remote access.<\/p>\n Post-exploitation, the actors run PowerShell commands to enumerate local users, groups, domain trust relationships, and network interfaces.\u00a0<\/p>\n Command and control channels are established via the RMM tools<\/a>, often tunneled through Cloudflare to evade detection.\u00a0<\/p>\n Exfiltration is executed using rclone, with stolen data transferred to attacker-controlled cloud storage. The final stage involves encrypting victim assets with Medusa <\/a>ransomware<\/a>, flagged by Microsoft Defender as Ransom Win32\/Medusa.<\/p>\nDeserialization Flaw (CVE-2025-10035)<\/strong><\/h2>\n