Historical intelligence backfill. This assessment covers reporting originally published on 2025-10-06 and was added to the RWP archive on 2026-09-07.

GoAnywhere CVE-2025-10035 was already a Medusa door when Fortra still sounded like a patch note

Microsoft tied Storm-1175 to zero-day abuse of Fortra GoAnywhere MFT's License Servlet, with watchTowr dating exploitation to 10 September — eight days before the public advisory.

RWP Ventures · 2026-09-07 · event 2025-09-10 · 4 min read · priority 9.1

This is the same product family that Clop burned in 2023 via CVE-2023-0669. Historical backfill of Microsoft's 6 October 2025 write-up; event window from 10 September; added 7 September 2026.

What happened

GoAnywhere sits on the internet because that is how enterprises move files with partners. The License Servlet is not a business feature users think about. A forged license response that deserializes attacker objects is therefore a quiet, pre-auth path.

Microsoft's intrusion sketch:

1. Exploit the then-unpatched servlet (zero-day relative to the public advisory).
2. Drop RMM — SimpleHelp and MeshAgent — under the GoAnywhere process.
3. Write JSP under GoAnywhere directories around the same time.
4. In at least one Microsoft-observed incident, proceed toward Medusa.

watchTowr described a backdoor admin named along the lines of admin-go, a web user, then second-stage plus SimpleHelp. Help Net Security and The Register covered the transparency fight: Fortra's early "am I impacted" notes read to researchers like IOCs offered without saying "you were exploited."

VulnCheck's important caveat: several labs assessed that exploitation appeared to require a private key not in public circulation. In-the-wild use means at least one adversary had that material. How they got it is UNKNOWN.

Why it mattered

MFT is crown-jewel adjacent: partner files, PII, payment data, sometimes OT/engineering drawings. It is also a 2023 lesson that the industry paid for and then repeated.

Storm-1175's broader habit — Microsoft later wrote about web-facing assets in Medusa operations (IT-023, later in this registry) — is volume scanning plus fast RMM, not a boutique implant. If your GoAnywhere is still on 443 without a WAF identity-aware broker, you are in that volume.

Who / what was affected

CONFIRMED GoAnywhere MFT instances that were unpatched as of mid-September 2025, especially internet-facing License Servlet.

REPORTED multiple organizations in Microsoft's telemetry; Medusa in at least one.

UNKNOWN complete victim list. Do not recycle 2023 Clop victim names as 2025 victims.

If you hosted GoAnywhere as SaaS or in a partner DMZ, assume the servlet was reachable unless you can prove otherwise.

Technical context

Related prior art: CVE-2023-0669, also GoAnywhere deserialization, also ransomware. Rapid7 noted the rhyme on day one of the 2025 advisory.

ATT&CK-relevant behaviors to hunt, not exploit:

• T1190 exploit public-facing application
• T1219 remote access software (SimpleHelp, MeshAgent)
• T1505.003 web shell (JSP in product directories)
• T1486 if Medusa encryption followed

RWP is not publishing gadget chains or license-forging steps.

Exploitation / threat status at the time

High confidence on vulnerability, zero-day window, and ransomware relevance. Moderate on how widely the private key spread.

What defenders should have done

1. Patch to 7.8.4 or 7.6.3 immediately. If you cannot, take the admin/license interfaces off the internet.
2. IR from 10 September 2025 (not from 18 September): new admin users, JSP under product paths, SimpleHelp/MeshAgent children of GoAnywhere, outbound RMM.
3. Rotate everything the MFT host could touch: file-share credentials, partner keys, service accounts, SSO tokens.
4. Treat "we were on the sustain branch" as irrelevant unless the build is 7.6.3+.
5. Add MFT to the same emergency-patch tier as VPNs and file-transfer appliances. It already earned that tier in 2023.

What we know now

By October 2025 the argument was over: this was a zero-day with KEV and a named ransomware affiliate. Later Storm-1175 web-app volume (spring 2026 Microsoft blog) is continuity of initial-access strategy, not a new CVE.

RWP assessment

Confidence: High. This is one of the window's clearest "internet-facing enterprise appliance → ransomware" cases.

If your board still thinks file transfer is a compliance tool, show them the License Servlet.

Defensive actions

1. Confirm current GoAnywhere build and whether the license/admin ports answer on the internet.
2. Hunt the RMM and JSP artifacts Microsoft and watchTowr described.
3. If any indicator hits, full IR — do not "just patch."
4. Put remaining MFT, VPN, and RMM appliances on a weekly exposure scan.