CODE RED • RANSOMWARE CAMPAIGN

ZERO-DAY RCE to RANSOMWARE: Critical GoAnywhere MFT Flaw Actively Exploited to Deploy Medusa

By CyberDudeBivash • October 07, 2025 • Threat Intelligence Report

cyberdudebivash.com | cyberbivash.blogspot.com

Disclosure: This is an urgent security advisory for IT and security professionals. It contains affiliate links to relevant enterprise security solutions. Your support helps fund our independent research.

Emergency Guide: Table of Contents

Following our **initial alert on the GoAnywhere MFT zero-day**, this is a CODE RED update with new threat intelligence. We can now confirm that the **Medusa ransomware** group is the primary threat actor behind the widespread exploitation of the unauthenticated RCE (CVE-2025-10035). They are not just stealing data; they are using this vulnerability as their initial access vector for full-scale, enterprise-wide ransomware deployments.

Chapter 1: The Adversary’s Playbook — Medusa Ransomware’s Post-Exploitation TTPs

The Medusa group’s kill chain is swift, aggressive, and effective.

Initial Access (RCE):** They exploit the insecure deserialization flaw in the GoAnywhere web interface to gain an initial shell on the server.
**Foothold & C2:** They immediately deploy a Cobalt Strike beacon, often injected into a legitimate system process to evade detection, for persistent command and control.
**Credential Theft:** They use tools like Mimikatz to dump credentials from the memory of the compromised MFT server, hunting for the credentials of a Domain Administrator.
**Lateral Movement:** Once they have privileged credentials, they use legitimate admin tools like **PsExec** to move laterally from the MFT server to the Domain Controllers and other critical servers on the network.
**Double Extortion:** They exfiltrate terabytes of sensitive data and then deploy their Medusa ransomware payload to encrypt the entire network.

Chapter 2: The Defender’s Playbook — Contain, Eradicate, and Recover

Your response must be immediate and multi-faceted.

1. CONTAIN: Patch or Isolate the Server NOW

This is your highest priority. Apply the emergency patch from the vendor immediately. If you cannot, you must take the server offline or use a firewall to block all public internet access to the web interface.

2. ERADICATE: Hunt for the TTPs (Assume Breach)

You must assume you have been compromised. Use your **EDR platform** to hunt for Medusa’s specific TTPs:

**Initial Exploit:** `ParentProcess: goanywhere.exe (or Java.exe) AND ProcessName IN (‘cmd.exe’, ‘/bin/sh’)`
**Cobalt Strike:** `SourceProcess: goanywhere.exe AND Event_Type:ProcessInjection AND TargetProcess:rundll32.exe`
**Lateral Movement:** Look for anomalous PsExec activity originating from your GoAnywhere server’s IP address.

3. RECOVER: The Importance of Backups

The only way to recover from a successful Medusa attack without paying the ransom is from clean, offline, and immutable backups. Test your backup and recovery plan now, before you need it.

Chapter 3: The Strategic Takeaway — The Systemic Risk of MFT Platforms

This incident, along with the infamous MOVEit campaign, proves that internet-facing Managed File Transfer (MFT) platforms are now the single most attractive target for major ransomware and extortion groups. These platforms are a perfect storm of risk: they are internet-facing by design, they process a company’s most sensitive data, and they are a direct link to a company’s most valuable business partners.

CISOs must treat their MFT platform as a Tier-0 critical asset, applying the same level of scrutiny, hardening, and advanced threat detection capabilities (like a modern **XDR**) as they would for their Domain Controllers. A failure to do so is an invitation for a catastrophic, business-ending breach.

Detect the Entire Kill Chain: A modern **XDR platform** is essential for detecting a multi-stage attack like this. It can correlate the initial exploit on the MFT server with the subsequent lateral movement and ransomware deployment inside your network, giving your SOC a unified view of the entire attack.

Get Urgent Zero-Day Alerts

Subscribe for real-time alerts, vulnerability analysis, and strategic insights. Subscribe

About the Author

CyberDudeBivash is a cybersecurity strategist with 15+ years in incident response, threat intelligence, and ransomware defense, advising CISOs across APAC. [Last Updated: October 07, 2025]

#CyberDudeBivash #Ransomware #Medusa #GoAnywhere #MFT #CVE #RCE #CyberSecurity #PatchNow #ThreatIntel #InfoSec

Cyberdudebivash