eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Actively Exploited GoAnywhere MFT Zero-Day Vulnerability
Bottom Line: Technical details and Proof-of-Concept (PoC) exploit code for a maximum severity vulnerability in Fortra's GoAnywhere MFT (CVE-2025-10035) was released on September 24th, 2025. Active exploitation was observed as early as September 10th, prior to public disclosure of the vulnerability on September 18th, making it a zero-day vulnerability.
Update: On October 6th, Microsoft attributed exploitation of CVE-2025-10035 to the Storm-1175 threat actor group. On September 25th, 2025, watchTowr Labs announced that a critical vulnerability in Fortra’s GoAnywhere Managed File Transfer (MFT), designated as CVE-2025-10035 (CVSS: 10), had been actively exploited in the wild prior to its formal disclosure. This vulnerability, initially disclosed by Fortra on September 18th, 2025, has been classified as a zero-day due to confirmed exploitation dating as early as September 10th, 2025.
CVE-2025-10035 is a deserialization vulnerability in the License Servlet of GoAnywhere MFT. The flaw allows threat actors to use a forged valid license response signature to deserialize arbitrary, attacker-controlled objects. This exploitation can lead to command injection, enabling attackers to execute arbitrary commands on the compromised system. watchTowr Labs indicated that threat actors exploited the flaw to bypass authentication and achieve Remote Code Execution (RCE). Further, the attack involved creating a backdoor administrator account named ‘admin-go’ that facilitated the creation of a web user and enabled the attackers to upload and execute additional payloads. Due to the confirmed exploitation, CISA added the flaw to its Known Vulnerability (KEV) catalog on September 29th, 2025, mandating federal agencies to mitigate it by October 23rd, 2025
While no specific threat actor or motive has been attributed to these attacks, a detailed Proof-of-Concept (PoC) exploit for the vulnerability, was published by watchTowr Labs on September 24th, 2025. The security firm Rapid7 also released a technical analysis of the vulnerability on the same day. In their advisory, Fortra indicated that the successful exploitation of CVE-2025-10035 largely relies on systems being exposed to the Internet.
eSentire Threat Intelligence Analysis:
The maximum severity of CVE-2025-10035 highlighted the urgent need for organizations to apply patches promptly, even before any reports of exploitation had emerged. However, the situation escalated significantly following watchTowr Lab’s release of a PoC exploit code and confirmation that exploitation had occurred prior to the disclosure. This development heightened the need for organizations to address the vulnerability immediately. While the associated advisory noted that successful exploitation relies on the systems being exposed to the Internet, watchTowr Labs pointed out that these systems are typically designed to be Internet-facing, emphasizing that the organizations should treat them as inherently vulnerable and take immediate protective measures.
watchTowr Labs reported that Fortra acknowledged identifying a vulnerability during a "security check" on September 11th, 2025, suggesting the vulnerability might have been discovered internally. They also highlighted that based on observed exploitation, the "Am I Impacted?" section of Fortra's advisory was actually sharing Indicators of Compromise (IoCs) for impacted devices. Although the flaw is now listed in CISA’s KEV catalog and the advisory includes IoCs, Fortra has not confirmed the exploitation. watchTowr Labs highlights this lack of clarity, emphasizing that Fortra had committed to transparency regarding in-the-wild exploits through its Secure by Design pledge.
In February 2023, the CLOP threat actor group exploited CVE-2023-0669 (CVSS: 7.2), a zero-day vulnerability in GoAnywhere MFT, to conduct data extortion. This vulnerability, like CVE-2025-10035, involved a pre-authentication command injection flaw in the License Response Servlet due to the deserialization of arbitrary attacker-controlled objects. While there is no current attribution of the ongoing exploitation to a specific threat actor, the previous attack by the CLOP threat actor group highlights the potential risk of ransomware and data extortion attacks stemming from vulnerabilities in file transfer applications.
Organizations are recommended to apply the relevant security patches and upgrade to latest secure versions including GoAnywhere MFT version 7.8.4, or the Sustain Release 7.6.3. As the GoAnywhere MFT instances are likely to be Internet-facing and thus vulnerable to CVE-2025-10035, organizations are advised to refer to Fortra’s recommendations to protect File Transfer Protocol (FTP) servers and Secure File Transfer Protocol (SFTP) servers. Implementation of robust Endpoint Detect and Response (EDR) solutions and continuous network monitoring would aide payload deployment detection post exploitation.
eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-10035. eSentire's MDR for Network has detections in place to identify CVE-2025-10035 exploitation activity. Known malicious IPs have been added to eSentire's Global Block List and a security advisory addressing the flaw was published on September 29th, 2025.
VMware Zero-Day Vulnerability
Bottom Line: A critical VMware vulnerability (CVE-2025-41244) has been exploited covertly for nearly a year by UNC5174, a Chinese state-sponsored actor. This enabled attackers to gain root access on virtual machines.
On September 29th, 2025, Broadcom released a critical security advisory addressing three vulnerabilities affecting VMware Aria Operations, VMware Tools, VMware Cloud Foundation, and VMware Telco Cloud products. These flaws include local privilege escalation, information disclosure, and improper authorization issues.
The most notable vulnerability from the release is CVE-2025-41244 (CVSS: 7.8). Broadcom states that “A malicious local actor with non-administrative privileges having access to a VM (Virtual Machine) with VMware Tools installed and managed by Aria Operations with SDMP (Service Discovery Management Pack) enabled may exploit this vulnerability to escalate privileges to root on the same VM”. NVISO Labs observed that this vulnerability had been exploited in the wild since mid-October 2024 and attributed its operations to the Chinese state-aligned threat actor UNC5174.
Exploitation may occur in both “credential-based” (Aria Operations invoking scripts in the guest VM) and “credential-less” modes (VMware Tools running service discovery directly). In both modes, the mismatch in path validation allows an unprivileged user to escalate to root. NVISO published a Proof-of-Concept (PoC) showing how staging a malicious executable /tmp/httpd and listening on a socket can lead to root access.
In addition to the actively exploited vulnerability, the advisory also highlights two other security vulnerabilities that, while not currently known to be exploited, still pose significant risks. CVE-2025-41245 (CVSS: 4.9) – “A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations”. CVE-2025-41246 (CVSS: 7.6) - “A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs”.
eSentire Threat Intelligence Analysis:
The presence of a local privilege escalation (CVE-2025-41244) in environments with VMware Tools and Aria Operations is concerning. If an attacker already has low-level access, they could escalate that access to gain full control of the VM. The information disclosure vulnerability (CVE-2025-41245) may lead to credential leaks within Aria Operations, which could facilitate further exploitation or lateral movement. The improper authorization vulnerability (CVE-2025-41246) in VMware Tools is particularly dangerous in environments using multi-tenant or shared virtualized deployments: it may permit cross-VM access if misused.
Broadcom recommends that all affected users apply the appropriate updates to mitigate the identified vulnerabilities. Users of VMware Tools on Windows and Linux should upgrade to VMware Tools version 13.0.5 or 12.5.4, depending on their current installation. Linux users should also ensure that the updated open-vm-tools are deployed through their respective distribution channels. Users of VMware Aria Operations should upgrade to version 8.18.5 to address the information disclosure vulnerability. VMware Cloud Foundation users are advised to update to VMware Cloud Foundation Operations 9.0.1.0. Similarly, users of VMware Telco Cloud Platform and Infrastructure should upgrade to VMware Aria Operations 8.18.5. Applying these updates will help prevent exploitation of the vulnerabilities and enhance the security of the affected systems.
The vulnerability (CVE-2025-41244) was exploited in the wild and NVISO attributes possible involvement to UNC5174, underscores that sophisticated adversaries are willing to incorporate such trivial-looking flaws into their toolkits. Exploitation of this sort may be part of a larger multi-stage intrusion. UNC5174 is believed to be a contractor working for the Chinese government. According to multiple sources, UNC5174 has targeted Western countries, including the US, Canada, and the UK, as well as NGOs in the Asia-Pacific region and businesses in the critical infrastructure sectors of energy, defense, and healthcare. They have been exploiting vulnerabilities in systems like F5 BIG-IP and ConnectWise ScreenConnect. Their operations typically involve deploying custom malware to maintain persistence. In this instance, the exploitation of CVE-2025-41244 reflects their ongoing strategy of leveraging zero-day vulnerabilities for covert intrusions into sensitive infrastructures.
In response, the eSentire Threat Intelligence team is actively tracking this topic for new details and detection opportunities. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-41245 and CVE-2025-41246, while plugins for CVE-2025-41244 are listed as coming soon.
CLOP Extortion Email Campaign
Bottom Line: Oracle has linked an ongoing email extortion campaign to vulnerabilities in its E-Business Suite that were patched in July 2025; this activity is potentially associated with the CLOP data extortion group.
Update: After the creation of this briefing on Friday October 3rd, new information regarding the extortion campaign emerged. In addition to the exploitation of known vulnerabilities, Oracle has confirmed the involvement of a previously unknown zero-day vulnerability (CVE-2025-61882). Furthermore, the involvement of the CLOP threat actor group has now been confirmed. The eSentire Threat Intelligence team published an advisory on this topic on October 6th, titled Oracle E-Business Suite Zero-Day Vulnerability (CVE-2025-61882).
Researchers from Google have identified a new extortion email campaign with potential ties to the CLOP (aka Cl0p, FIN11, TA505) threat actor group. CLOP is a Russian-speaking financially motivated data extortion group, that is believed to operate out of a Commonwealth of Independent States (CIS) country
Starting on late September, executives at various organizations began to receive extortion demands via email. The emails claimed that threat actors had compromised Oracle E-Business Suite applications and exfiltrated sensitive data; the senders threaten to release or sell stolen data if an extortion demand is not met. If the extortion demand is met, the threat actors claim that stolen data will be deleted and technical recommendations will be shared to prevent similar attacks. The extortion emails were sent from hundreds of compromised accounts but included contact addresses associated with a known CLOP data leak site.
On October 2nd, 2025, Oracle confirmed the legitimacy of the extortion campaign. Oracle did not provide specific details on real-world attacks but noted that the activity involved “previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update”. The July Oracle patch release included nine vulnerabilities for Oracle E-Business Suite. Of those vulnerabilities, only three are listed as remotely exploitable without authentication (CVE-2025-30745, CVE-2025-30746, CVE-2025-50107).
eSentire Threat Intelligence Analysis:
While the specific vulnerability/vulnerabilities exploited in this campaign are not confirmed, organizations are strongly encouraged to apply all relevant security patches from the July 2025 patch release. Executives that receive suspicious emails are advised to forward them the appropriate security teams and eSentire’s Security Operations Center for investigation. It should be noted that reception of a similar extortion email is not confirmation of a breach. Threat actors are known to impersonate established threat actor groups and well publicized campaigns, capitalizing on their success in order to socially engineer potential victims into sending funds.
At the time of writing, it is not confirmed that CLOP is responsible for this activity but based on available details it is probable. The group’s activity has been tracked under the name TA505 since at least 2014, but the name CLOP was adopted in 2019 due to their Ransomware-as-a-Service (RaaS) operation run under the same name. CLOP has since switched from ransomware deployment to data theft for extortion attacks only. This approach has been adopted by other ransomware groups, such as Babuk, as the attacks are quicker and less likely to be detected when compared with double extortion ransomware campaigns.
The activity reported on by Google and Oracle closely aligns with past confirmed CLOP activity. Past campaigns have included exploitation Accellion File Transfer Appliance (FTA) vulnerabilities in 2020 and 2021, GoAnywhere in early 2023, and MOVEit in mid-2023. eSentire’s Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
