Fortra GoAnywhere MFT Vulnerability Exploited by Chinese Ransomware Group

What's Happening?

A critical vulnerability in Fortra's GoAnywhere Managed File Transfer (MFT) software, identified as CVE-2025-10035, has been exploited by a Chinese ransomware group known as Storm-1175. The flaw, which allows for command injection and remote code execution, was disclosed on September 18, 2025, and has a CVSS score of 10/10. Despite the release of patches, the vulnerability was exploited as a zero-day since at least September 10, 2025. The attackers used the vulnerability to create backdoor administrator accounts and access the MFT service, deploying tools like SimpleHelp and MeshAgent for remote monitoring and management. They also used a Cloudflare tunnel for command-and-control communication and the Rclone tool for data exfiltration. The Medusa ransomware was deployed on at least one compromised network.

Why It's Important?

The exploitation of this vulnerability highlights significant cybersecurity risks, particularly from financially motivated hacking groups. The incident underscores the importance of timely patch management and the potential consequences of delayed responses to known vulnerabilities. Organizations using GoAnywhere MFT are at risk of data breaches and ransomware attacks, which can lead to financial losses and operational disruptions. The involvement of a Chinese group also points to the ongoing threat of international cybercrime and the need for robust cybersecurity measures across industries.

What's Next?

Fortra is expected to update its advisory to warn users of the ongoing exploitation of the vulnerability. Organizations using GoAnywhere MFT should apply patches immediately and review their security protocols to prevent unauthorized access. Cybersecurity firms and agencies may increase monitoring and provide additional guidance to mitigate risks. The incident may prompt further investigation into how the attackers obtained the private keys necessary for exploitation, potentially leading to broader security reviews and policy changes.

Beyond the Headlines

This case raises questions about the security of software supply chains and the potential for insider threats or sophisticated social engineering attacks. The incident may lead to increased scrutiny of software vendors' security practices and the need for transparency in vulnerability disclosures. It also highlights the ethical responsibility of companies to protect user data and the potential legal implications of failing to do so.