Technical intelligence and weaponization dossier for CVE-2023-0669. Documented exploitation across 1 active malware families totaling 140 analyzed telemetry samples.
| Vulnerability ID | CVE-2023-0669 |
|---|---|
| Common Name / Bulletin | Fortra GoAnywhere MFT Deserialization Remote Code Execution (Fortra Security Advisory) |
| CWE Classification | CWE-502: Deserialization of Untrusted Data in LicenseResponseServlet |
| Affected Software & Versions | Fortra GoAnywhere MFT versions prior to 7.1.2 |
| Technical Root Cause | Zero-day pre-authentication command injection via Java object deserialization in the LicenseResponseServlet endpoint, weaponized in mass ransomware campaigns by Clop and LockBit. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| clop | Ransomware | 140 | Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempes... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2023-0669 in enterprise networks:
HTTP POST to /goanywhere/lic/accept/ with bundle parameters containing Base64-encoded serialized Java objects; anomalous process execution from tomcat.exe.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →