Critical GoAnywhere bug exploited in ransomware campaign.

Summary

By the CyberWire staff

Critical GoAnywhere bug exploited in ransomware campaign.

Microsoft has discovered a vulnerability, tracked as CVE-2025-10035, in Fortra's GoAnywhere Managed File Transfer (MFT) software. The vulnerability, rated a maximum CVSS score of 10.0, lets attackers bypass license signature verification and achieve remote code execution on vulnerable systems. This exploitation requires no authentication if the attacker can forge or intercept a valid license response, creating significant risk to internet-facing instances.

Microsoft linked this zero-day vulnerability to Storm-1175, which has previously used legitimate remote monitoring tools, network scanners, and Cloudflare tunnels for command-and-control before deploying Medusa ransomware. Forta previously patched the flow on September 18; however, hundreds of GoAnywhere servers remain exposed.

Microsoft has urged immediate patching, network perimeter reviews, and running endpoint defenses in block mode.

Redis warns of a critical flaw allowing remote code execution.

A Redis vulnerability, tracked as CVE-2025-49844, allows attackers to gain remote code execution on affected systems. The flaw, rated CVSS 10.0, stems from a bug in Redis' Lua scripting feature, which is enabled by default. Authenticated attackers can exploit the flaw to escape the Lua sandbox, trigger memory corruption, and establish a reverse shell for persistent access.

Researchers at Wiz have dubbed the vulnerability "RediShell" and warned that over 330,000 Redis instances are exposed online, with at least 60,000 requiring no authentication. Exploited systems risk data theft, ransomware, or cryptomining. Redis has issued patches for all supported versions and urges immediate updates.

BIETA is tied to China's Ministry of State Security.

A new report from Recorded Future's Insikt Group ties the Beijing Institute of Electronics Technology and Application (BIETA) to the Chinese Ministry of State Security (MSS). Researchers stated that BIETA is very likely MSS-led and likely a public front for the MSS First Research Institute, with subsidiary CIII selling supporting technologies.

Public sources have indicated that the BIETA researchers focus on steganography, communications, and forensics while collaborating with the MSS-run University of International Relations. These activities likely aid intelligence, counterintelligence, and military operations.

Researchers warned:

"Public evidence of the MSS's very likely vast network of front organizations and cooptation of entities for intelligence activities is increasing. This evidence includes cybersecurity companies engaged in offensive operations, universities leveraged for intellectual property theft, non-profit organizations used for social influence, and ... research institute ... to provide technology enablement."

Notes.

Today's issue includes events affecting , and the People's Republic of China the United States.

Attacks, Threats, and Vulnerabilities

Well, Well, Well. It’s Another Day. (Oracle E-Business Suite Pre-Auth RCE Chain - CVE-2025-61882) (WatchTowr Labs) Today, we’re going to walk through the exploit chain (that we’ve verified, nerds) being used to compromise Oracle E-Business Suite deployments (and was used as a zero-day) - now tagged as CVE-2025-61882.

Ransomware Group “Trinity of Chaos” Launches Data Leak Site (Infosecurity Magazine) A new TOR data leak site published by the Trinity of Chaos ransomware group unveils 39 firms’ data and threatens Salesforce litigation

Trends

Deloitte refunds Australian government over AI in report (The Register) Big Four consultancy billed Canberra top dollar, only for investigators to find bits written by a chatbot.

Research and Development

The Nobel Prize for physics is awarded for discoveries in quantum mechanical tunneling (NPR) The Nobel committee said that the laureates' work provides opportunities to develop "the next generation of quantum technology, including quantum cryptography, quantum computers, and quantum sensors."

Litigation, Investigation, and Law Enforcement

EyeMed Agrees to Pay $5M to Settle Email Breach Litigation (Gov Info Security) Benefits provider EyeMed Vision Care has agreed to pay $5 million and improve its security practices to settle class action litigation involving a 2020 phishing

LinkedIn sues ProAPIs for using 1M fake accounts to scrape user data (BleepingComputer) LinkedIn has filed a lawsuit against Delaware company ProAPIs Inc. and its founder and CTO, Rehmat Alam, for allegedly scraping legitimate data through more than a million fake accounts.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CyberArk IMPACT25 World Tour Identity Security Summit (Long Beach, California, USA, Oct 7, 2025) We're bringing best-in-class insights from CyberArk IMPACT to a city near you! Join us in Long Beach for IMPACT World Tour, where you'll gain exclusive access to the latest advancements, technologies, and trends shaping the future of identity security. Engage with CyberArk experts and industry peers through strategic presentations and deep-dive discussions — all designed to arm you with the right tools and knowledge to strengthen your identity security program.

DTEX NEXT (Virtual, Oct 7, 2025) DTEX NEXT is where the future of proactive security takes shape. Join us as we unveil our latest advancements in DTEX Insider Risk Management (IRM) and DTEX Risk-Adaptive Data Loss Prevention (DLP), powered by industry-leading behavioral science, advanced AI, and our strategic collaboration with AWS.

Don’t miss Jen Easterly, former CISA Director, headlining HIP Conf 25 (Charleston, SC, USA, Oct 7 - 9, 2025) Jen Easterly, former CISA Director, keynotes HIP Conf 2025. A globally recognized cybersecurity leader, Easterly brings unmatched insight into hybrid identity security and resilience. Register now for this must-attend event.

AI Agent Security Summit in San Francisco (San Franciso, California, USA, Oct 8, 2025) After launching in NYC, the AI Agent Security Summit heads to San Francisco to continue shaping how enterprises secure the next wave of AI. On Wednesday, October 8, join us at the historic Commonwealth Club in San Francisco.

Uniting Women in Cyber 2025 (Crystal City, Virginia, USA, Oct 9, 2025) UWIC is the premier event for cybersecurity leaders, professionals, and aspiring practitioners. Connect with a vibrant community focused on emerging global trends, technological advancements, and workforce development. Attend UWIC 2025 to learn, share ideas, and expand your professional network!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.07.25

Top stories.

Critical GoAnywhere bug exploited in ransomware campaign.

Redis warns of a critical flaw allowing remote code execution.

BIETA is tied to China's Ministry of State Security.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Research and Development

Litigation, Investigation, and Law Enforcement

Events