Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |
| CVE-2025-24472 | 8.1 | 7.2% | ✅ listed | available | 77.58 (High) |
| CVE-2022-24521 | 7.8 | 7.1% | ✅ listed | available | 74.83 (High) |
| CVE-2023-27532 | 7.5 | 77.6% | ✅ listed | available | 75.75 (High) |
| CVE-2023-22527 | 9.8 | 100.0% | ✅ listed | available | 89.5 (Critical) |
| CVE-2024-0012 | 9.8 | 99.7% | ✅ listed | available | 85.83 (Critical) |
Mora_001: New Ransomware Coterie Running SuperBlack
Forescout researchers have identified a new ransomware coterie, Mora_001, that has been active since January 2026 and is running SuperBlack ransomware built from leaked LockBit 3.0 source code.
Mora_01 exploits CVE-2024-55591 and CVE-2025-24472 to break into and establish presence in victims’ environments. Both are authentication bypass flaws in FortiOS and FortiProxy that Fortinet disclosed in January. The first, CVE-2024-55591, is a CVSS 9.8 critical that allows a remote attacker to gain super-admin privileges via crafted requests to the Node.js websocket module. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19, as well as 7.2.0 through 7.2.12. The second, CVE-2025-24472, is a CVSS 8.1 high affecting the same version ranges and lets an unauthenticated attacker with prior knowledge of upstream and downstream devices bypass authentication.
A shared qTox ID and matching post-exploitation patterns tie Mora_001 to LockBit. The SuperBlack binary is compiled from the leaked LockBit 3.0 source, and the qTox ID appears in both groups’ post-exploitation scripts. The same qTox ID and pattern set also show up in NightSpire, Gunra, and Hunters International, all of which use the same Fortinet pair for initial access.
The Fortinet Auth Bypass: CVE-2024-55591
CVE-2024-55591 is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) in Fortinet’s FortiOS and FortiProxy appliances. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19, plus 7.2.0 through 7.2.12. A remote unauthenticated attacker gains super-admin privileges by sending crafted requests to the Node.js websocket module embedded in the appliance.
The bug scores CVSS 9.8 (v3.1) and sits at EPSS 98.3% (100th percentile), making it one of the most actively exploited Fortinet flaws in recent memory. It is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public PoC is available. Precursor Intelligence rates it at PRS risk 89.88 (Critical). Fortinet disclosed it in January 2025, but Arctic Wolf Labs confirmed in-the-wild exploitation beginning in November 2024, with mass exploitation running through December 2024 across four distinct phases: scanning, reconnaissance, SSL VPN configuration, and final payload delivery.
How the Exploit Works
The exploit works by sending crafted HTTP requests to the Node.js websocket module embedded in the FortiGate/FortiProxy appliance. A remote unauthenticated attacker hits the websocket endpoint with a malicious payload that bypasses the standard authentication path, granting super-admin privileges without any prior session or credential exchange.
Once the websocket request is processed, the attacker generates a random admin or local user account directly on the affected device. This account is created via a scheduled task and persists across rebots, giving the attacker a durable foothold even if the original websocket session is terminated. The account name and password are generated per-exploit, so each compromised device gets a unique local admin.
Fortinet confirmed in-the-wild exploitation for CVE-2024-55591, with Arctic Wolf Labs observing mass exploitation from November 16 through December 2024 across four phases: scanning, reconnaissance, SSL VPN configuration, and final payload delivery. CVE-2025-24472 is the second authentication bypass in the same advisory, covering the same FortiOS and FortiProxy version ranges and adding a second websocket path for the unauthenticated attacker.
Post-Exploitation: From FortiGate to Ransomware
Once the super-admin account is live, the attacker runs Mimikatz against LSASS on the FortiGate host to pull credentials, then enumerates Active Directory from the same source to map the domain. This is the standard credential-access and discovery pair for this kill chain.
For staging and exfiltration, the operator drops Everything.exe on the target server, builds a 7-Zip archive, and pushes it out over WinSCP, MEGACmd, or Rclone. The three-step sequence runs in order: Everything.exe for file discovery, 7-Zip for compression, then the outbound transfer tool. This is the same pattern NightSpire uses for its data theft phase.
Encryption is handled by SuperBlack, the LockBit 3.0 variant. The payload encrypts the staged files and drops a R3ADM3.txt ransom note on each encrypted volume. The note contains the standard LockBit 3.0 text with the victim’s ID and the decryption key.
Who Was Hit
The victims span four industries: government, logistics, healthcare, and networking. Fortinet disclosed both CVEs in January 2025, but CVE-2024-55591 was the primary zero-day exploited in the wild. Fortinet confirmed in-the-wild exploitation for 55591 specifically; CVE-2025-24472 is the second authentication bypass in the same advisory, covering the same FortiOS and FortiProxy version ranges and adding a second websocket path for the unauthenticated attacker.
Key points
- Mora_001 is a new ransomware coterie active since January 2026, identified by Forescout researchers.
- The group runs SuperBlack ransomware built from leaked LockBit 3.0 source code, with a shared qTox ID and post-exploitation patterns tying it to LockBit.
- Initial access exploits CVE-2024-55591 (CVSS 9.8, EPSS 98.3%, KEV) and CVE-2025-24472 (CVSS 8.1, EPSS 7.2%, KEV) to create super-admin accounts on FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 / 7.2.0–7.2.12.
- The vulnerability is an Authentication Bypass via Alternate Path or Channel (CWE-288) in the Node.js WebSocket module, allowing remote unauthenticated attackers to gain super-admin via crafted requests.
- Mora_001 also includes a data wiper associated with BlackMatter and BrainCypher, indicating a multi-operator build.
Further reading & sources
- New ransomware gang shows LockBit link
- Fortinet discloses second firewall auth bypass patched in January
- NightSpire Ransomware: How It Works and How to Defend Against It
- Ransomware Tool Matrix Project Updates: May 2025
- Fortinet fixes FortiOS zero-day exploited by attackers for months (CVE-2024-55591) - Help Net Security
- Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained