Microsoft Connects GoAnywhere Zero-Day to Ransomware Campaigns
TL;DR
Microsoft links the threat group Storm-1175 to exploiting a critical deserialization vulnerability in Fortra GoAnywhere (CVE-2025-10035) to deploy Medusa ransomware, with active exploitation since September 2025, involving system compromise, lateral movement, and data exfiltration.
- Microsoft Links Storm-1175 to GoAnywhere Exploit Deploying Medusa Ransomware The Hacker News
- Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability Microsoft
- Microsoft: Critical GoAnywhere bug exploited in ransomware attacks BleepingComputer
- Microsoft Links ‘Active Exploitation’ Of GoAnywhere To Cybercrime Group CRN Magazine
- Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks SecurityWeek
Want the full story? Read the original reporting
Read on The Hacker News