{"id":50611,"date":"2023-02-17T17:35:00","date_gmt":"2023-02-17T17:35:00","guid":{"rendered":"https:\/\/www.darkreading.com\/endpoint\/massive-goanywhere-rce-exploit"},"modified":"2023-02-17T17:35:00","modified_gmt":"2023-02-17T17:35:00","slug":"massive-goanywhere-rce-exploit-everything-you-need-to-know","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/","title":{"rendered":"Massive GoAnywhere RCE Exploit: Everything You Need to Know"},"content":{"rendered":"
<\/div>\n

Last week, the Cybersecurity and Infrastructure Security Agency (CISA) added<\/a> three new entries to its Known Exploited Vulnerabilities catalog. Among them was CVE-2023-0669<\/a>, a bug that has paved the way for exploits and follow-on ransomware attacks against hundreds of organizations in recent weeks.<\/p>\n

The bug was discovered in GoAnywhere, a Windows-based file-sharing software from Fortra, formerly HelpSystems. According to its website, GoAnywhere is used at more than 3,000 organizations to manage documents of all kinds. According to data from Enlyft<\/a>, most of those are large organizations \u2014 with at least 1,000 and, often, more than 10,000 employees \u2014 mostly based in the United States.<\/p>\n

The bug tracked as CVE-2023-0669 allows hackers to remotely execute code in target systems, through the internet, without need for authentication. As of this writing, this vulnerability has not yet received an official CVSS rating<\/a> from the National Vulnerability Database.<\/p>\n

But we need not wonder about how dangerous it is, as hackers have already pounced. On Feb. 10 \u2014 days after Fortra released a patch<\/a> \u2014 the Clop ransomware gang claimed<\/a> to have exploited CVE-2023-0669 in over 130 organizations.<\/p>\n

After three weeks and counting, it’s unclear whether or not more organizations are still at risk.<\/p>\n

Timeline of the GoAnywhere Exploit(s)<\/h2>\n

On Feb. 2, two abnormal commands triggered alerts in an IT environment monitored by endpoint detection and response (EDR) vendor Huntress. Both were executed on a host designated for processing transactions on the GoAnywhere platform, though the significance of this wasn’t clear yet.<\/p>\n

“At first glance, the alert itself was fairly generic,” wrote Joe Slowik<\/a>, threat intelligence manager for Huntress. “But further analysis revealed a more interesting set of circumstances.”<\/p>\n

An entity on this alerted network had attempted to download a file from a remote resource. Slowik and his colleagues tried to access the file themselves, but by then the port used to download it had been closed up. “We don’t really know for certain why,” Slowik tells Dark Reading. “It’s possible that the adversary was working at a very rapid clip.”<\/p>\n

They did have the IP address of that entity, however, which traced back to Bulgaria, and was flagged as malicious by VirusTotal. The actor seemed to be from outside of the organization, and had used their first command to download and run a dynamic link library (DLL) file.<\/p>\n

“Knowing that the DLL was also executed further raised the risk level of the incident,” Slowik says, “since if it was malware that was downloaded, it is now running on the system.”<\/p>\n

There were other signs, too, that this was a compromise. But even after isolating the relevant server, a second server at the targeted organization became infected. “We were worried that we had a very persistent adversary,” Slowik recalls.<\/p>\n

The researchers still lacked a copy of the downloaded malware, but all of the evidence surrounding it seemed to accord with activity previously associated with a malware family called Truebot. “The post in the URI structure that was used mapped to earlier Truebot samples,” Slowik says. “The DLL exports that were referenced in order to launch the malware, or similar to historical tripod samples, as well as some strings and code structures, all matched. Within the samples themselves, all of it aligned very nicely with what had previously been reported in 2022 for Truebot.”<\/p>\n

Truebot has been linked to a prolific<\/a> Russian<\/a> group<\/a> called<\/a> TA505<\/a>. Notably, TA505 has utilized the ransomware-as-a-service (RaaS) malware “Clop<\/a>” in previous attacks.<\/p>\n

On the same day as Slowik’s investigation, reporter Brian Krebs publicly republished an advisory Fortra<\/a> had sent to its users the day before. GoAnywhere was being exploited, its developers explained, and they were implementing a temporary service outage in response.<\/p>\n

Whatever mitigations were taken weren’t enough. On Feb. 10, hackers behind the Clop ransomware told Bleeping Computer<\/a> that they\u2019d used the GoAnywhere exploit to breach over more than organizations.<\/p>\n

How CVE-2023-0669 Works<\/h2>\n

CVE-2023-0669 is a cross-site request forgery (CSRF) but that arises from how unpatched GoAnywhere users install their software licenses.<\/p>\n

Interestingly, it was as much a design choice as an oversight. “Typically, installing a license involves downloading a license file from a server and uploading it to your device,” explains Ron Bowes, lead security researcher for Rapid7, who released the most detailed publicized analysis<\/a> of how an internal user could trigger the exploit. “Fortra chose to make that whole process transparent, where the license is delivered through the administrator’s browser. That means the user gets a much smoother experience.”<\/p>\n

However, that seamlessness came at a cost. “There is no CSRF protection (and the cookie is not actually required, so no authentication is required to exploit this issue),” Bowes explained in his analysis. “That means that this can, by design, be exploited via cross-site request forgery.”<\/p>\n

In its report, Rapid7 labeled the exploitability of this vulnerability as “very high.”<\/p>\n

“While the administration port should not be exposed to the internet,” Bowes says, “it’s very easy to configure it that way by mistake. And once an attacker understands the vulnerability, it can be exploited without any risk of crashing the application or corrupting data.”<\/p>\n

Rapid7 also labeled “very high” the value of such an exploit to an attacker. As Bowes explains, “due to the nature of the application (managed file transfer, or MFT), it’s common for a GoAnywhere MFT server to sit on a network perimeter and to have the file transfer ports publicly exposed. This makes it a good target for both pivoting into an organization’s internal network, and\/or stealing potentially sensitive data directly off the target.”<\/p>\n

On Feb. 6, Fortra fixed CVE-2023-0669<\/a> “by adding what they call a ‘license request token,'” Bowes explains, “which is included in the encrypted request to Fortra’s server. It behaves exactly as a CSRF token would, preventing an attacker from leveraging an administrator’s browser.”<\/p>\n

What to Do Now<\/h2>\n

As severe as the exploit is, only a fraction of GoAnywhere customers are vulnerable to outside hackers through CVE-2023-0669. However, even those without Internet-exposed GoAnywhere instances are still vulnerable to internal users or attackers who have gained initial compromise to a network via regular Web browsers.<\/p>\n

The bug can be exploited remotely if an organization\u2019s GoAnywhere administration port \u2014 8000 or 8001 \u2014 is exposed on the Internet. As of last week, more than 1,000 GoAnywhere instances<\/a> were exposed, but, Bleeping Computer explained, only 135 of those pertained to the relevant ports 8000 and 8001. Most of those vulnerable seem to have already been swept up in one big campaign by the Clop group.<\/p>\n

“We urgently advise all GoAnywhere MFT customers to apply this patch,” Fortra wrote in another advisory<\/a> to its internal customers. “Particularly for customers running an admin portal exposed to the Internet, we consider this an urgent matter.”<\/p>\n

Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Weeks after an exploit was first announced in a popular cloud-based file transfer service, could some organizations still be vulnerable? The answer is yes.Read More HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-50611","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"\nMassive GoAnywhere RCE Exploit: Everything You Need to Know 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Massive GoAnywhere RCE Exploit: Everything You Need to Know 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-17T17:35:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Massive GoAnywhere RCE Exploit: Everything You Need to Know\",\"datePublished\":\"2023-02-17T17:35:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\"},\"wordCount\":1131,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\",\"url\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\",\"name\":\"Massive GoAnywhere RCE Exploit: Everything You Need to Know 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg\",\"datePublished\":\"2023-02-17T17:35:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage\",\"url\":\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg\",\"contentUrl\":\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.threatshub.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Massive GoAnywhere RCE Exploit: Everything You Need to Know\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#website\",\"url\":\"https:\/\/www.threatshub.org\/blog\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\/\/www.threatshub.org\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Massive GoAnywhere RCE Exploit: Everything You Need to Know 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/","og_locale":"en_US","og_type":"article","og_title":"Massive GoAnywhere RCE Exploit: Everything You Need to Know 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-02-17T17:35:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Massive GoAnywhere RCE Exploit: Everything You Need to Know","datePublished":"2023-02-17T17:35:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/"},"wordCount":1131,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/","url":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/","name":"Massive GoAnywhere RCE Exploit: Everything You Need to Know 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg","datePublished":"2023-02-17T17:35:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blta414029ec692d019\/62d197e874ec84724da69ab0\/Exploit_Tiny_Ivan_Alamy.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/massive-goanywhere-rce-exploit-everything-you-need-to-know\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Massive GoAnywhere RCE Exploit: Everything You Need to Know"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/50611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=50611"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/50611\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=50611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=50611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=50611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}