A critical deserialization vulnerability in GoAnywhere MFT License Servlet (CVE-2025-10035, CVSS 10.0) allows forged license responses to deserialize attacker-controlled objects, enabling command injection and potential remote code execution; Microsoft observed exploitation by Storm-1175 leading to deployment of RMM tools, Rclone exfiltration, and Medusa ransomware. #CVE-2025-10035 #Storm-1175 #Medusa
Keypoints
- GoAnywhere MFT License Servlet (up to version 7.8.3) contains a critical deserialization flaw (CVE-2025-10035) that can be exploited via a forged license response signature.
- Exploitation can result in command injection and potential remote code execution without authentication for internet-exposed instances.
- Microsoft observed active exploitation by the threat actor cluster tracked as Storm-1175, with activity noted on September 11, 2025.
- Post-exploitation TTPs included dropping RMM tools (SimpleHelp, MeshAgent), creating .jsp files, performing discovery (netscan), lateral movement via mstsc.exe, and establishing C2 (Cloudflare tunnel).
- Exfiltration using Rclone and eventual deployment of Medusa ransomware were observed in at least one compromised environment.
- Microsoft recommends immediate patching to the latest GoAnywhere version, perimeter hardening, EDR in block mode, automated investigation/remediation, and enabling attack surface reduction rules.
- Microsoft Defender products provide detections, vulnerability management coverage, XDR hunts, and remediation guidance for related exploitation and post-compromise activity.
MITRE Techniques
- [T1521 ] Resource Hijacking – Attackers abused the GoAnywhere License Servlet deserialization to execute attacker-controlled objects, enabling command injection and RCE (“bypass signature verification by crafting a forged license response signature, which then allows the deserialization of arbitrary, attacker-controlled objects”).
- [T1204 ] User Execution – Creation and likely use of .jsp web shells within GoAnywhere MFT directories to execute commands (“creation of .jsp files within the GoAnywhere MFT directories was observed”).
- [T1078 ] Valid Accounts – Use of remote monitoring and management (RMM) tools like SimpleHelp and MeshAgent to maintain persistence and remote access (“They abused remote monitoring and management (RMM) tools, specifically SimpleHelp and MeshAgent. They dropped the RMM binaries directly under the GoAnywhere MFT process”).
- [T1018 ] Remote System Discovery – Deployment of tools such as netscan for network discovery to identify further targets (“They deployed tools like netscan for network discovery”).
- [T1021 ] Remote Services – Lateral movement via mstsc.exe to move across systems in the compromised network (“Lateral movement was achieved using mstsc.exe, allowing the threat actor to move across systems”).
- [T1090 ] Proxy/Tunneling – Setup of a Cloudflare tunnel for secure command-and-control communication (“even set up a Cloudflare tunnel for secure C2 communication”).
- [T1048 ] Exfiltration Over Alternative Protocol – Use of Rclone for data exfiltration from at least one victim environment (“During the exfiltration stage, the deployment and execution of Rclone was observed in at least one victim environment”).
- [T1486 ] Data Encrypted for Impact – Deployment of Medusa ransomware as the final action on objectives in one compromised environment (“Ultimately, in one compromised environment, the successful deployment of Medusa ransomware was observed”).
Indicators of Compromise
- [File Hash ] RMM binaries dropped during Storm-1175 activity – 4106c35ff46bb6f2f4a42d63a2b8a619f1e1df72414122ddf6fd1b1a644b3220 (MeshAgent), c7e2632702d0e22598b90ea226d3cde4830455d9232bd8b33ebcb13827e99bc3 (SimpleHelp)
- [File Hash ] Additional SimpleHelp hashes observed – cd5aa589873d777c6e919c4438afe8bceccad6bbe57739e2ccb70b39aee1e8b3, 5ba7de7d5115789b952d9b1c6cff440c9128f438de933ff9044a68fff8496d19
- [IP Address ] IPs associated with SimpleHelp infrastructure – 31[.]220[.]45[.]120, 45[.]11[.]183[.]123 (additional IP 213[.]183[.]63[.]41 also observed)
- [File Name / Artifact ] Web shell indicators and artifacts – creation of .jsp files within GoAnywhere MFT directories (observed alongside dropped RMM tools)
- [Vulnerability ] Affected software and CVE – GoAnywhere MFT License Servlet up to version 7.8.3 vulnerable to CVE-2025-10035 (critical deserialization leading to potential RCE)