Medusa Ransomware Actors Exploit Critical Fortra GoAnywhere Flaw

Microsoft observed Storm-1175 exploiting a critical deserialization flaw (CVE-2025-10035) in Fortra's GoAnywhere MFT as a zero-day, resulting in at least one confirmed Medusa ransomware deployment; the campaign was observed on Sept. 11, before the vendor patch. Analysts question how attackers satisfied a required private-key license signature—raising possibilities of a leaked/stolen key or compromised Fortra infrastructure. Fortra released patches and advisories, Microsoft published IoCs and mitigation guidance, and CISA added the flaw to its Known Exploited Vulnerabilities catalog.