Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
3 matching stories
FortiProxyForescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0
Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.
AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'
AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.
CISA Issues #StopRansomware Advisory for Gunra Ransomware
CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.
