Goanywhere MFT CVE-2025-10035 Exploitation

Tim Peck@timpeck

•updated Oct 6, 2025•1•1•109

Detects suspicious child processes spawned by the GoAnywhere MFT Tomcat service. This behavior is consistent with post-exploitation activity following a successful remote code execution exploit of CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.