{"id":26020,"date":"2025-10-06T10:22:27","date_gmt":"2025-10-06T18:22:27","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2025\/10\/06\/news-19739\/"},"modified":"2025-10-06T10:22:27","modified_gmt":"2025-10-06T18:22:27","slug":"news-19739","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2025\/10\/06\/news-19739\/","title":{"rendered":"Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability"},"content":{"rendered":"

Credit to Author: Microsoft Threat Intelligence| Date: Mon, 06 Oct 2025 17:00:00 +0000<\/strong><\/p>\n

On September 18, 2025, Fortra published a security advisory<\/a> regarding a critical deserialization vulnerability in GoAnywhere MFT’s License Servlet, which is tracked as CVE-2025-10035<\/a> and has a CVSS score of 10.0. The vulnerability could allow a threat actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection and potential remote code execution (RCE). A cybercriminal group tracked by Microsoft Threat Intelligence as Storm-1175, known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the vulnerability.<\/p>\n

Microsoft urges customers to upgrade to the latest version following Fortra\u2019s recommendations.  We are publishing this blog post to increase awareness of this threat and to share end-to-end protection coverage details across Microsoft Defender, as well as security posture hardening recommendations for customers.<\/p>\n

Vulnerability analysis <\/h2>\n

The vulnerability, tracked as CVE-2025-10035, is a critical deserialization flaw impacting GoAnywhere MFT\u2019s License Servlet Admin Console versions up to 7.8.3. It enables an attacker to bypass signature verification by crafting a forged license response signature, which then allows the deserialization of arbitrary, attacker-controlled objects.<\/p>\n

Successful exploitation could result in command injection and potential RCE on the affected system. Public reports indicate that exploitation does not require authentication if the attacker can craft or intercept valid license responses, making this vulnerability particularly dangerous for internet-exposed instances.<\/p>\n

The impact of CVE-2025-10035 is amplified by the fact that, upon successful exploitation, attackers could perform system and user discovery, maintain long-term access, and deploy additional tools for lateral movement and malware. Public advisories recommend immediate patching, reviewing license verification mechanisms, and closely monitoring for suspicious activity in GoAnywhere MFT environments to mitigate risks associated with this vulnerability.<\/p>\n

Exploitation activity by Storm-1175  <\/h2>\n

Microsoft Defender researchers identified exploitation activity in multiple organizations aligned to tactics, techniques, and procedures (TTPs) attributed to Storm-1175. Related activity was observed on September 11, 2025.<\/p>\n

An analysis of the threat actor\u2019s TTPs reveals a multi-stage attack. For initial access, the threat actor exploited the then-zero-day deserialization vulnerability in GoAnywhere MFT. To maintain persistence, they abused remote monitoring and management (RMM) tools, specifically SimpleHelp and MeshAgent. They dropped the RMM binaries directly under the GoAnywhere MFT process. In addition to these RMM payloads, the creation of .jsp<\/em> files within the GoAnywhere MFT directories was observed, often at the same time as the dropped RMM tools.<\/p>\n

The threat actor then executed user and system discovery commands and deployed tools like netscan for network discovery. Lateral movement was achieved using mstsc.exe<\/em>, allowing the threat actor to move across systems within the compromised network.<\/p>\n

For command and control (C2), the threat actor utilized RMM tools to establish their infrastructure and even set up a Cloudflare tunnel for secure C2 communication. During the exfiltration stage, the deployment and execution of Rclone was observed in at least one victim environment. Ultimately, in one compromised environment, the successful deployment of Medusa ransomware was observed.<\/p>\n

Mitigation and protection guidance<\/h2>\n

Microsoft recommends the following mitigations to reduce the impact of this threat. <\/p>\n