Microsoft Links Storm-1175 to GoAnywhere Exploit Deploying Medusa Ransomware

Summary

The article reports on Microsoft attributing the exploitation of a GoAnywhere vulnerability (CVE-2025-10035) to the Storm-1175 threat actor, leading to Medusa ransomware deployment. The attack involves RMM tools, lateral movement, and data exfiltration.

Key Takeaways

1. Microsoft attributed Storm-1175 to exploiting a critical GoAnywhere flaw (CVE-2025-10035) to deploy Medusa ransomware.
2. Successful exploitation of CVE-2025-10035 could allow attackers to perform system and user discovery, maintain long-term access, and deploy additional tools for lateral movement and malware.
3. The attack chain involves dropping RMM tools, lateral movement using mstsc.exe, and data exfiltration via Rclone before Medusa ransomware deployment.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article primarily relies on information from Microsoft Threat Intelligence and cybersecurity firm watchTowr, both credible sources in the cybersecurity field. It provides specific technical details about the vulnerability and attack chain. The article also includes direct quotes from a CEO, adding a layer of expert opinion.

Bias assessment: Cybersecurity Threat Awareness. The article focuses on informing readers about a specific cybersecurity threat and how it is being exploited. The language used is technical and aims to raise awareness and encourage preventative measures. There's a slight bias towards highlighting the potential impact on organizations using GoAnywhere MFT.

Note: While the article presents information from credible sources, readers should independently verify the details and implement security measures.

Credibility flag: Informative, Vigilant

Claimed Facts (7)

• States the final goal of the attack.
• This is a direct attribution of an attack to a specific actor.
• This provides specific details about the vulnerability.
• This provides information on the patch version.
• This provides background information on the threat actor.
• This provides a timeline of the exploitation.
• Describes the tools and methods used in the attack.

Opinions (5)

• This is an interpretation of the situation.
• This is an opinion on the impact of the vulnerability.
• Expresses a need for more information from a specific source.
• Expresses a value judgement on how companies should behave.
• Expresses a hope for future action.

Claims (5)

• The term "silent assault" is an exaggeration and lacks specific evidence.
• This is a question posed without any evidence to suggest private keys were involved.
• This implies a deliberate act of negligence without providing proof.
• The word "often" is vague and lacks specific quantification.
• "Indications" is vague and doesn't provide concrete evidence of exploitation.

Key Sources

• Microsoft — Tech Giant
• Microsoft Threat Intelligence team — Cybersecurity Research
• watchTowr — Cybersecurity Firm
• Benjamin Harris — watchTowr CEO and Founder