GoAnywhere MFT Zero-Day Exploited for Medusa Ransomware

A cybercrime group is actively exploiting a critical zero-day vulnerability in Fortra's GoAnywhere MFT software to deploy Medusa ransomware. Tracked as CVE-2025-10035, the maximum-severity flaw allows for remote code execution and was leveraged in attacks before a patch was available. Attackers gain initial access through the vulnerability, then use remote management tools for persistence and move laterally across networks. The group exfiltrates data before deploying the ransomware payload to encrypt victim files, impacting numerous critical infrastructure organizations. Security experts urge administrators to immediately upgrade to the latest patched version and inspect system logs for signs of compromise.