Medusa Ransomware Strikes Again: Storm-1175 Exploits Critical GoAnywhere MFT Zero-Day Flaw

Rising Cyber Chaos: How Storm-1175 Turned a Zero-Day into a Global Threat

In a chilling escalation of cyberattacks, a dangerous hacker collective known as Storm-1175 has been exploiting a critical vulnerability in GoAnywhere MFT (CVE-2025-10035) to deploy Medusa ransomware across targeted systems worldwide. The flaw, described as a maximum severity deserialization bug, enables remote command injection — essentially allowing attackers to seize full control of vulnerable servers without user interaction.

This breach, confirmed by WatchTowr Labs and later corroborated by Microsoft, reveals a disturbing timeline: the vulnerability was being actively abused eight days before Fortra’s public disclosure. The attackers’ precision and speed highlight a new era of ransomware efficiency, where patches arrive too late and exploitation begins almost immediately after discovery.

WatchTowr’s analysts detailed that exploitation of CVE-2025-10035 began on September 10, 2025, while Fortra’s fix wasn’t released until September 18. This means organizations were left exposed for over a week, unknowingly offering a free pass to attackers. The vulnerability lies in the License Servlet component of GoAnywhere MFT, allowing malicious actors to inject arbitrary commands by forging a valid license response.

Microsoft’s forensic breakdown ties these intrusions directly to Storm-1175, a known Medusa ransomware affiliate. The attackers gained access through this zero-day, establishing persistence via remote monitoring and management (RMM) tools such as SimpleHelp and MeshAgent. Once inside, they executed Netscan for reconnaissance, mstsc.exe for lateral movement, and Rclone for data exfiltration before finally deploying the Medusa payload.

Even more concerning, Microsoft observed Cloudflare tunnels being used for secure command-and-control (C2) operations — a stealth technique that cloaks malicious communications under legitimate cloud infrastructure. This makes traditional network defenses blind to ongoing exploitation.

Both Microsoft and Fortra have urged immediate patching and enhanced monitoring, recommending EDR block mode, attack surface reduction rules, and cloud protection mechanisms to detect or prevent similar intrusions. However, with attackers already active in the wild, these measures might come too late for some organizations.

What Undercode Say:

The Storm-1175 exploitation campaign showcases a perfect storm of timing, sophistication, and opportunism. The attack wasn’t random — it was a strategic move exploiting corporate dependency on unmanaged file transfer systems. GoAnywhere MFT has long been a trusted enterprise tool, and this trust ironically became its greatest vulnerability.

From a technical perspective, CVE-2025-10035 represents more than a coding flaw; it exposes a philosophical weakness in enterprise security culture. Companies continue to prioritize uptime and functionality over timely patching. The attackers exploited not only software but human complacency.

By leveraging legitimate RMM tools, Storm-1175 blurred the line between normal IT operations and malicious behavior. SimpleHelp and MeshAgent, typically used for remote troubleshooting, became the attackers’ Trojan horses. This tactic undermines the old security model of “block the bad, allow the good,” proving that contextual behavioral analysis is now more critical than signature-based defense.

The use of Cloudflare tunnels marks an evolution in ransomware tactics. Rather than relying on shady infrastructure that can be blacklisted, threat actors are now hiding behind mainstream cloud providers. This shift forces defenders to rethink how they define “trusted traffic.” In today’s threat landscape, legitimate infrastructure is being weaponized at scale.

It’s also worth noting how rapid the timeline was: within days of discovering the vulnerability, Storm-1175 operationalized it. This shows an industrial-level coordination behind ransomware ecosystems. Affiliates like Storm-1175 don’t just exploit code; they exploit timing — racing against security teams to weaponize vulnerabilities before patches go public.

Medusa ransomware itself remains one of the more disciplined families in the ransomware ecosystem. Its affiliates use modular deployment, custom encryption, and multi-stage exfiltration. The presence of Rclone indicates that data theft and extortion are primary goals, not mere encryption-for-ransom schemes. The group’s persistence methods, particularly through RMM tools, allow them to silently control compromised systems even after initial detections.

Organizations using GoAnywhere MFT must now assume compromise if they delayed patching. Even after applying Fortra’s September 18 fix, forensic analysis is essential to identify lingering persistence mechanisms. Attackers often leave sleeper agents — scripts, scheduled tasks, or hidden RMM configurations — to regain entry later.

The key lesson from this breach isn’t just “patch faster.” It’s “assume breach” and build resilience around that assumption. Detection, segmentation, and automated response must evolve beyond simple reactive patching. Threat actors like Storm-1175 operate with military-level precision; defending against them requires a mindset shift from prevention to continuous validation.

In the broader sense, this incident exposes the fragile trust structure of the modern software supply chain. Fortra’s delayed advisory and partial IOCs (Indicators of Compromise) may have unintentionally widened the window of exposure. The security community must demand greater transparency and faster coordinated disclosure, especially when exploitation is already confirmed.

The Medusa-Storm-1175 operation also raises a red flag about data sovereignty. With Rclone exfiltrating sensitive information to unknown cloud destinations, many organizations now face not only operational risk but also regulatory scrutiny. GDPR, HIPAA, and other frameworks impose strict penalties for breaches involving third-party negligence.

Ultimately, this isn’t an isolated attack — it’s a warning. As enterprise tools become more interconnected, every unpatched node becomes a potential gateway to ransomware chaos. Storm-1175 simply capitalized on that reality with precision timing and technical finesse.

Fact Checker Results

✅ Vulnerability Confirmed: CVE-2025-10035 exists and has been publicly disclosed by Fortra.
✅ Exploitation Verified: WatchTowr Labs and Microsoft both confirmed in-the-wild exploitation tied to Medusa ransomware.
⚠️ Risk Ongoing: Unpatched GoAnywhere MFT servers remain at high risk of compromise despite vendor fixes.

Prediction

Given the pattern of exploitation and continued reliance on enterprise file transfer systems, it’s highly likely that Storm-1175 or similar ransomware affiliates will continue targeting MFT software in the coming months. Expect follow-up attacks leveraging new zero-days or reusing this vector against unpatched systems. Unless companies accelerate their patch cycles and adopt zero-trust monitoring, Medusa ransomware could evolve into one of the most financially damaging threats of 2025.