Microsoft: Critical GoAnywhere Bug Exploited in Medusa Ransomware Campaign

Microsoft warns of active exploitation of CVE-2025-10035, a critical deserialization flaw in Fortra GoAnywhere MFT (CVSS 10.0) that can bypass license signature verification and enable arbitrary object deserialization, leading to command injection and remote code execution. Observed exploitation by Storm-1175 involved use of legitimate RMM tools (SimpleHelp, MeshAgent), network discovery, lateral movement via mstsc.exe, Cloudflare tunnels for C2, Rclone for exfiltration, and final deployment of Medusa ransomware; Fortra released a patch but hundreds of GoAnywhere instances remain internet-exposed, prompting urgent mitigation guidance.