New Ransomware Operator Exploits Fortinet Vulnerability Duo
Essential information
- Published
- 14/03/2025 19:18
- Modified
- 14/03/2025 19:33
- Tags
- 2025-03-14 CVE-2024-55591 CVE-2025-24472 data exfiltration firewall fortinet lateral movement lockbit ransomware superblack wipeblack
- Related entities
- 23 observables, 1 intrusion sets (apt), 17 techniques (mitre), 2 malware, 8 others
Description
A new ransomware operator, dubbed Mora_001, has been exploiting Fortinet firewall vulnerabilities CVE-2024-55591 and CVE-2025-24472 to gain unauthorized access and deploy a modified version of LockBit ransomware. The threat actor creates persistent admin accounts, exfiltrates firewall configurations, and uses VPN access for lateral movement. They selectively target file servers for encryption after data theft. The ransomware, named SuperBlack, uses LockBit's infrastructure but removes branding. The actor employs a custom VPN brute-forcing tool and leaves ransom notes linking to LockBit's Tox chat ID. This campaign highlights the increasing trend of exploiting perimeter security appliances and the evolving ransomware landscape.