Storm-1175 Exploits Flaws in High
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-10035 | Deserialization Flaw in Fortra GoAnywhere MFT License Servlet Enables RCE CVE-2025-10035 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw (CWE-502) in the License Servlet of Fortra GoAnywhere Managed File Transfer (MFT). It is triggered when the servlet processes a license response carrying a validly forged signature, causing it to deserialize an arbitrary attacker-controlled object; the CVSS vector indicates the attack is network-based and requires no privileges or user interaction. Successful exploitation can lead to command injection (CWE-77), effectively giving an attacker command execution on the MFT server and access to the files and credentials that flow through it. Any organization running GoAnywhere MFT, which is commonly deployed as a central file-transfer hub, is affected, although specific affected/fixed version ranges are not provided in the available data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-09-29 with known ransomware use, Microsoft attributes attacks to the Storm-1175 ransomware affiliate (Medusa, now reportedly replaced by StormEncryptor), and EPSS assigns a 99.8% probability of exploitation within 30 days. Do: Apply mitigations or patches per Fortra's vendor instructions immediately, as this is a KEV entry carrying BOD 22-01 requirements for federal agencies (patch or discontinue use if mitigations are unavailable). Because a ransomware affiliate (Storm-1175, using Medusa/StormEncryptor) is actively exploiting it, hunt for compromise: review License Servlet traffic and logs for forged license responses, check for unexpected processes or new accounts, and look for signs of lateral movement. Until patched, restrict or remove internet exposure of GoAnywhere MFT admin and license interfaces. | 9.8 | 100% | KEV ransomware |
| moderatelow thousands of internet-exposed GoAnywhere MFT instances (estimate) |
Full article483 words · extracted from infosecurity-magazine.com · click to collapse
A prolific cybercrime group has been weaponizing n-day and zero-day exploits in high-tempo Medusa ransomware attacks over the past three years, Microsoft has revealed.
Storm-1175 is a financially motivated actor that usually exploits the window between vulnerability disclosure and patch adoption, Microsoft said in a blog post on April 6.
“The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the UK and US,” it said.
The group has exploited at least 16 vulnerabilities in this way since 2023, including three zero-day flaws such as CVE-2025-10035. That vulnerability in GoAnywhere Managed File Transfer, was exploited one week before public disclosure last year.
Read more on Storm-1175: Microsoft: Critical GoAnywhere Bug Exploited in Medusa Ransomware Campaign
Microsoft pointed to several typical TTPs used by Storm-1175:
- The group creates a web shell or drops a remote access payload to establish an initial foothold – moving from initial access to ransomware deployment in one to six days
- It establishes persistence by creating a new user and adding that user to the administrator’s group
- It rotates various tools for reconnaissance and lateral movement, including living-off-the-land binaries (LOLBins), such as PowerShell and PsExec, followed by Cloudflare tunnels to move laterally over Remote Desktop Protocol (RDP) and deliver payloads to new devices
- It uses multiple remote monitoring and management (RMM) tools during post-compromise activity such as creating new user accounts, enabling alternative command-and-control (C2) methods, delivering additional payloads, or using as interactive remote desktop sessions
- Legitimate software deployment tool PDQ Deployer is sometimes used to silently install applications for lateral movement and payload delivery
- Python-based tool Impacket is sometimes used for lateral movement and credential dumping
- The group occasionally modifies Microsoft Defender Antivirus settings stored in the registry to prevent it blocking ransomware payloads
How to Tackle Storm-1175
Microsoft said the group has already exploited vulnerabilities in Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, GoAnywhere MFT, SmarterMail and BeyondTrust.
To mitigate the threat of attack, organizations should first use perimeter scanning tools to understand the extent of their attack surface, Microsoft recommended. Web-facing systems should be isolated from the public internet with a secure network boundary and accessed only via a virtual private network (VPN).
If they must be connected, organizations should place these systems behind a web application firewall (WAF), reverse proxy, or perimeter network (aka DMZ), the report continued.
Microsoft also recommended:
- Following its ransomware guidance on credential hygiene and limiting lateral movement
- Implementing Credential Guard to protect credentials stored in process memory
- Turning on tamper protection to prevent attackers from stopping security services or using antivirus exclusions
- Removing unapproved RMM installations and adding multi-factor authentication (MFA) to approved ones
- Configuring XDR tools to prevent common attack techniques used in ransomware attacks
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/storm1175-medusa-attacks/