detailed<\/a> by Microsoft on Monday, a cybercrime group, the computing giant tracks as Storm-1175, has exploited the flaw – and could still have access to a victim’s environment even after admins apply a patch. The threat actor previously exploited internet-connected applications to gain access to a victim’s network on order to deploy Medusa ransomware.<\/p>\n“The impact of CVE-2025-10035 is amplified by the fact that, upon successful exploitation, attackers could perform system and user discovery, maintain long-term access and deploy additional tools for lateral movement and malware,” Microsoft warned.<\/p>\n
Fortra said a customer first alerted it to the attacks on Sept. 11, after which it launched an investigation. “We inspected customer logs, researched the exposure of on-premises customer admin consoles and analyzed our MFTaaS – Fortra-hosted – instances for indicators of compromise,” including reviewing the logs for every one of the cloud-based instances.<\/p>\n
The same day, the company directly contacted on-premises customers that exposed GoAnywhere MFT software’s admin console to the internet. “Our support team provided risk mitigation measures and further assistance to these customers as requested,” it said.<\/p>\n
Fortra said that when reviewing its managed-file-as-a-transfer service environment instances and verifying that they didn’t expose admin controls, it did find three MFTaaS instances that showed signs of attackers having attempted to exploit the vulnerability against them. “We promptly isolated these instances for further investigation and contacted the customers,” it said.<\/p>\n
Fortra Lets the Mystery Be<\/p>\n
Vulnerability researcher Benjamin Harris, CEO of threat intelligence firm watchTowr, while lauding Fortra’s overall transparency, said the vendor still hasn’t answered questions pertaining to exactly how attackers were able to forge valid GoAnywhere MFT licenses.<\/p>\n
Fortra declined to comment.<\/p>\n
Harris said his “conjecture” is that the company’s private key leaked, which “would let attackers sign malicious objects that every GoAnywhere instance on the planet would happily accept.” Another possibility is that the private key fell victim to an attacker who activated a GoAnywhere product and slipped a malicious object into the automatically generated request for a new license to be signed.<\/p>\n
“The mystery remains – watchTowr researchers and others are still unclear how this vulnerability could be exploited without access to a private key that only Fortra is believed to have access to,” Harris said.<\/p>\n
![\"Fortra](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2025\/10\/fortra-confirms-unauthorized-activity-hit-goanywhere-mft-image_large-3-a-29701.jpg\")