‘An attacker's playground:’ Crims exploit GoAnywhere perfect-10 bug

Security researchers have confirmed that threat actors have exploited the maximum-severity vulnerability affecting Fortra's GoAnywhere managed file transfer (MFT), and chastised the vendor for a lack of transparency. The experts over at watchTowr, never ones to mince their words, described the revelation as "an increasingly disappointing situation," criticizing Fortra for not sharing enough details about the exploitation status of CVE-2025-10035. The Register reported on the vulnerability last week after Fortra disclosed it on September 18. In our story, we noted that Fortra did not confirm whether it was actively being exploited under its "Am I Impacted?" section. "Exploitation of this vulnerability is highly dependent upon systems being externally exposed to the internet," it said at the time. The watchTowr researchers Xeeted that it was likely that exploits had already been successful, and in their latest blog, they said that they received evidence of attacks using the vulnerability on September 10. According to watchTowr's findings, attackers trigger the pre-auth deserialization bug to achieve remote code execution (RCE) capability, then create backdoor admin accounts and web users before executing multiple follow-on payloads. "Unfortunately, the picture now painted allows for evidence-based confidence in the concern that Fortra's 'Am I Impacted?' section probably was not Fortra attempting to be overly helpful, but a thinly veiled way of sharing 'Indicators of Compromise,...