New kids on the ransomware block channel Lockbit to raid Fortinet firewalls

Researchers are tracking a newly discovered ransomware group with suspected links to LockBit after a series of intrusions were reported starting in January. Forescout said the group it's tracking as Mora_001 exploited two Fortinet vulnerabilities to gain an initial foothold in victim environments before securing persistence and ultimately deploying a new ransomware researchers dubbed SuperBlack. Both CVE-2024-55591 and CVE-2025-24472 are authentication bypass vulnerabilities disclosed by Fortinet in January. The former was disclosed first as a zero-day, since exploit activity went back to December 2024, and the latter was added to the advisory after the fact. At the time of CVE-2024-55591's disclosure on January 14, researchers already said criminals were running a "mass exploitation campaign" against the vendor's firewalls. A proof-of-concept (PoC) exploit made its way online on January 27 and within 96 hours, Forescout said, FortiOS was being actively exploited using that PoC as a guide. After gaining an initial foothold, attackers then escalated their privileges to super-admin and created additional admin accounts to secure persistent access. The attackers named these accounts similarly to existing legitimate ones, just with a single added digit appended, and added them to a VPN group to blend in and go unnoticed during casual admin reviews, researchers assume. In cases where victims had no VPN capabilities, attackers would try to gain access to adjacent firewalls using th...