Medusa malware active exploitation (CVE-2025-10035)

Cohesity REDLab has released updates to the threat library to detect emerging Medusa variants that are actively exploiting targets in the wild. Users should closely monitor ant-ransomware backup anomalies in Security Center. Threat Scan feature should also be used in tandem to scan backup data using the default threat library or custom YARA rules. Users should also run periodic file-hash scans to detect dormant malware in backup data.

Analysis

Active exploitation of a critical vulnerability in Fortra’s GoAnywhere Managed File Transfer (MFT) software (CVE-2025-10035) has been observer by numerous vendors including Microsoft. This flaw resides in the License Servlet component and stems from insecure deserialization of license response objects. Attackers can craft malicious payloads that, when deserialized, allow unauthenticated remote code execution (RCE). The severity is heightened because the vulnerability is accessible without authentication, making internet-facing MFT instances particularly exposed.

Threat actors have leveraged this flaw to deploy Medusa ransomware. The attack sequence begins with sending a specially crafted license response to the vulnerable servlet, triggering arbitrary code execution. Once access is obtained, the ransomware executes a series of automated routines: it enumerates files, encrypts them using strong symmetric algorithms, and can exfiltrate sensitive data for double-extortion purposes. The exploitation demonstrates a combination of application-layer vulnerability abuse and sophisticated ransomware techniques, illustrating the dangers of deserialization flaws.

Summary

Cohesity’s Anti-Ransomware and Threat Detection feature lets you scan backups snapshots and secondary stored data for anomalous behavior, known malware signatures, indicators of compromise (IOCs), using both built-in threat feeds and custom YARA rules. This helps ensure that the data recovered from backups is clean and avoids re-infecting production after a breach. It works by integrating curated threat intelligence and anomaly detection into Cohesity data protection platform so that customers can schedule or initiate threat scans over backups, inspect snapshots for malicious or suspicious artifacts, flag or quarantine compromised backups, and then use those evaluations to guide rapid recovery and response.

References:

• CISA: https://www.cisa.gov/news-events/alerts/2025/09/29/cisa-adds-five-known-exploited-vulnerabilities-catalog
• MICROSOFT: https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
• FORTA: https://www.fortra.com/security/advisories/product-security/fi-2025-012
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10035