[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCMnYiIjMKFqeiQeBTUvcT53qU18OV77awHwvjxrbX5s":3,"$fJjtFrlsqRUFyfZim4JBs0VG5PJZ1oN-p96rJL8V3Wbk":128},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":125,"created_at":126,"updated_at":127,"published_at":69},"forescout-researchers-identify-new-ransomware-coterie-mora-001-running-superblac","Forescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0","Mora_001, active since January 2026, exploits CVE-2024-55591 and CVE-2025-24472 to break into FortiOS\u002FFortiProxy and deploys SuperBlack ransomware with a shared qTox ID tying it to LockBit.","Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.",[10,11,12,13,14,15],"Mora_001","SuperBlack","LockBit 3.0","FortiOS","FortiProxy","CVE-2024-55591","# Forescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0\n\n*Mora_001, active since January 2026, exploits CVE-2024-55591 and CVE-2025-24472 to break into FortiOS\u002FFortiProxy and deploys SuperBlack ransomware with a shared qTox ID tying it to LockBit.*\n\n**Tags:** `Mora_001` `SuperBlack` `LockBit 3.0` `FortiOS` `FortiProxy` `CVE-2024-55591`\n\n> Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |\n| CVE-2025-24472 | 8.1 | 7.2% | ✅ listed | available | 77.58 (High) |\n| CVE-2022-24521 | 7.8 | 7.1% | ✅ listed | available | 74.83 (High) |\n| CVE-2023-27532 | 7.5 | 77.6% | ✅ listed | available | 75.75 (High) |\n| CVE-2023-22527 | 9.8 | 100.0% | ✅ listed | available | 89.5 (Critical) |\n| CVE-2024-0012 | 9.8 | 99.7% | ✅ listed | available | 85.83 (Critical) |\n\n## Mora_001: New Ransomware Coterie Running SuperBlack\n\nForescout researchers have identified a new ransomware coterie, **Mora_001**, that has been active since January 2026 and is running **SuperBlack** ransomware built from leaked LockBit 3.0 source code.\n\nMora_01 exploits **CVE-2024-55591** and **CVE-2025-24472** to break into and establish presence in victims’ environments. Both are authentication bypass flaws in FortiOS and FortiProxy that Fortinet disclosed in January. The first, CVE-2024-55591, is a CVSS 9.8 critical that allows a remote attacker to gain super-admin privileges via crafted requests to the Node.js websocket module. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19, as well as 7.2.0 through 7.2.12. The second, CVE-2025-24472, is a CVSS 8.1 high affecting the same version ranges and lets an unauthenticated attacker with prior knowledge of upstream and downstream devices bypass authentication.\n\nA shared qTox ID and matching post-exploitation patterns tie Mora_001 to LockBit. The SuperBlack binary is compiled from the leaked LockBit 3.0 source, and the qTox ID appears in both groups’ post-exploitation scripts. The same qTox ID and pattern set also show up in NightSpire, Gunra, and Hunters International, all of which use the same Fortinet pair for initial access.\n\n## The Fortinet Auth Bypass: CVE-2024-55591\n\nCVE-2024-55591 is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) in Fortinet’s FortiOS and FortiProxy appliances. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19, plus 7.2.0 through 7.2.12. A remote unauthenticated attacker gains super-admin privileges by sending crafted requests to the Node.js websocket module embedded in the appliance.\n\nThe bug scores CVSS 9.8 (v3.1) and sits at EPSS 98.3% (100th percentile), making it one of the most actively exploited Fortinet flaws in recent memory. It is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public PoC is available. Precursor Intelligence rates it at PRS risk 89.88 (Critical). Fortinet disclosed it in January 2025, but Arctic Wolf Labs confirmed in-the-wild exploitation beginning in November 2024, with mass exploitation running through December 2024 across four distinct phases: scanning, reconnaissance, SSL VPN configuration, and final payload delivery.\n\n## How the Exploit Works\n\nThe exploit works by sending crafted HTTP requests to the Node.js websocket module embedded in the FortiGate\u002FFortiProxy appliance. A remote unauthenticated attacker hits the websocket endpoint with a malicious payload that bypasses the standard authentication path, granting super-admin privileges without any prior session or credential exchange.\n\nOnce the websocket request is processed, the attacker generates a random admin or local user account directly on the affected device. This account is created via a scheduled task and persists across rebots, giving the attacker a durable foothold even if the original websocket session is terminated. The account name and password are generated per-exploit, so each compromised device gets a unique local admin.\n\nFortinet confirmed in-the-wild exploitation for CVE-2024-55591, with Arctic Wolf Labs observing mass exploitation from November 16 through December 2024 across four phases: scanning, reconnaissance, SSL VPN configuration, and final payload delivery. CVE-2025-24472 is the second authentication bypass in the same advisory, covering the same FortiOS and FortiProxy version ranges and adding a second websocket path for the unauthenticated attacker.\n\n## Post-Exploitation: From FortiGate to Ransomware\n\nOnce the super-admin account is live, the attacker runs Mimikatz against LSASS on the FortiGate host to pull credentials, then enumerates Active Directory from the same source to map the domain. This is the standard credential-access and discovery pair for this kill chain.\n\nFor staging and exfiltration, the operator drops Everything.exe on the target server, builds a 7-Zip archive, and pushes it out over WinSCP, MEGACmd, or Rclone. The three-step sequence runs in order: Everything.exe for file discovery, 7-Zip for compression, then the outbound transfer tool. This is the same pattern NightSpire uses for its data theft phase.\n\nEncryption is handled by SuperBlack, the LockBit 3.0 variant. The payload encrypts the staged files and drops a R3ADM3.txt ransom note on each encrypted volume. The note contains the standard LockBit 3.0 text with the victim’s ID and the decryption key.\n\n## Who Was Hit\n\nThe victims span four industries: government, logistics, healthcare, and networking. Fortinet disclosed both CVEs in January 2025, but CVE-2024-55591 was the primary zero-day exploited in the wild. Fortinet confirmed in-the-wild exploitation for 55591 specifically; CVE-2025-24472 is the second authentication bypass in the same advisory, covering the same FortiOS and FortiProxy version ranges and adding a second websocket path for the unauthenticated attacker.\n\n## Key points\n\n- Mora_001 is a new ransomware coterie active since January 2026, identified by Forescout researchers.\n- The group runs SuperBlack ransomware built from leaked LockBit 3.0 source code, with a shared qTox ID and post-exploitation patterns tying it to LockBit.\n- Initial access exploits CVE-2024-55591 (CVSS 9.8, EPSS 98.3%, KEV) and CVE-2025-24472 (CVSS 8.1, EPSS 7.2%, KEV) to create super-admin accounts on FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 \u002F 7.2.0–7.2.12.\n- The vulnerability is an Authentication Bypass via Alternate Path or Channel (CWE-288) in the Node.js WebSocket module, allowing remote unauthenticated attackers to gain super-admin via crafted requests.\n- Mora_001 also includes a data wiper associated with BlackMatter and BrainCypher, indicating a multi-operator build.\n\n## Further reading & sources\n\n- [New ransomware gang shows LockBit link](https:\u002F\u002Fwww.computing.co.uk\u002Fnews\u002F2025\u002Fsecurity\u002Fransomware-gang-lockbit-link)\n- [Fortinet discloses second firewall auth bypass patched in January](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffortinet-discloses-second-firewall-auth-bypass-patched-in-january\u002F)\n- [NightSpire Ransomware: How It Works and How to Defend Against It](https:\u002F\u002Fprovendata.com\u002Fblog\u002Fnightspire-ransomware)\n- [Ransomware Tool Matrix Project Updates: May 2025](https:\u002F\u002Fblog.bushidotoken.net\u002F2025\u002F05\u002Fransomware-tool-matrix-project-updates.html)\n- [Fortinet fixes FortiOS zero-day exploited by attackers for months (CVE-2024-55591) - Help Net Security](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2025\u002F01\u002F14\u002Ffortinet-fortigate-zero-day-vulnerability-exploited-cve-2024-55591\u002F)\n- [Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained](https:\u002F\u002Fwww.picussecurity.com\u002Fresource\u002Fblog\u002Fgunra-ransomware-multithreaded-chacha20-encryption-explained)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fforescout-researchers-identify-new-ransomware-coterie-mora-001-running-superblac.png?v=ed02f05fb9",{"cves":19,"iocs":57,"actors":63,"malware":92,"targets":108,"timeline":113,"technologies":118},[20,29,36,42,47,51],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2022-24521",true,"\u002Fvulnerabilities\u002FCVE-2022-24521",7.8,0.0713,"High",74.83,"3.1",{"id":30,"kev":22,"poc":22,"url":31,"cvss":32,"epss":33,"risk_band":34,"risk_score":35,"cvss_version":28},"CVE-2023-22527","\u002Fvulnerabilities\u002FCVE-2023-22527",9.8,0.9998,"Critical",89.5,{"id":37,"kev":22,"poc":22,"url":38,"cvss":39,"epss":40,"risk_band":26,"risk_score":41,"cvss_version":28},"CVE-2023-27532","\u002Fvulnerabilities\u002FCVE-2023-27532",7.5,0.8133,75.75,{"id":43,"kev":22,"poc":22,"url":44,"cvss":32,"epss":45,"risk_band":34,"risk_score":46,"cvss_version":28},"CVE-2024-0012","\u002Fvulnerabilities\u002FCVE-2024-0012",0.9986,85.83,{"id":15,"kev":22,"poc":22,"url":48,"cvss":32,"epss":49,"risk_band":34,"risk_score":50,"cvss_version":28},"\u002Fvulnerabilities\u002FCVE-2024-55591",0.9415,89.88,{"id":52,"kev":22,"poc":22,"url":53,"cvss":54,"epss":55,"risk_band":26,"risk_score":56,"cvss_version":28},"CVE-2025-24472","\u002Fvulnerabilities\u002FCVE-2025-24472",8.1,0.0724,77.58,[58,61],{"type":59,"value":60},"domain","picussecurity.com",{"type":59,"value":62},"security.com",[64,71,76,80,84,88],{"url":65,"name":66,"slug":67,"type":68,"origin":69,"motivation":70},"\u002Fthreat-groups\u002Flockbit","LockBit","lockbit","ransomware",null,"financial",{"url":72,"name":73,"slug":74,"type":68,"origin":75,"motivation":70},"\u002Fthreat-groups\u002Fblackmatter","BlackMatter","blackmatter","Russia (suspected; Russian-speaking operators, assessed rebrand of DarkSide)",{"url":77,"name":10,"slug":78,"type":79,"origin":69,"motivation":69},"\u002Fthreat-groups\u002Fmora-001","mora-001","unknown",{"url":81,"name":82,"slug":83,"type":68,"origin":69,"motivation":70},"\u002Fthreat-groups\u002Fnightspire","NightSpire","nightspire",{"url":85,"name":86,"slug":87,"type":68,"origin":69,"motivation":70},"\u002Fthreat-groups\u002Fhunters-international","Hunters International","hunters-international",{"url":89,"name":90,"slug":91,"type":68,"origin":69,"motivation":70},"\u002Fthreat-groups\u002Fgunra","Gunra","gunra",[93,94,96,98,100,102,104,106],{"name":11},{"name":95},"Mimikatz",{"name":97},"7-Zip",{"name":99},"WinSCP",{"name":101},"MEGACmd",{"name":103},"Rclone",{"name":105},"Everything.exe",{"name":107},"R3ADM3.txt",[109],{"name":110,"sector":111,"status":112,"geography":69},"Fortinet","networking","confirmed",[114],{"date":115,"event":116,"description":117},"2025-01-14","Cve disclosure","Fortinet discloses CVE-2024-55591",[119,120,121,122],{"vendor":110,"product":110},{"vendor":110,"product":13},{"vendor":110,"product":14},{"vendor":123,"product":124},"Check Point","VPN","threat_actor_activity","2026-09-21T07:06:18.647672+00:00","2026-10-16T12:28:19.638128+00:00",{"articles":129},[130,140,149,162],{"slug":131,"title":132,"summary":133,"tags":134,"hero_image_url":137,"story_type":138,"created_at":139},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.",[135,90,136,13,14,15],"CISA","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","ransomware_incident","2026-08-27T17:06:47.703652+00:00",{"slug":141,"title":142,"summary":143,"tags":144,"hero_image_url":147,"story_type":125,"created_at":148},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.",[90,145,146,13,14,136],"AhnLab ASEC","Operation Double Barrel","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"slug":150,"title":151,"summary":152,"tags":153,"hero_image_url":160,"story_type":125,"created_at":161},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[154,155,156,157,158,159],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":163,"title":164,"summary":165,"tags":166,"hero_image_url":173,"story_type":125,"created_at":174},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[167,168,169,170,171,172],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00"]