Threat Actor Activity27d ago·6 sources
Forescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0
Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.
Mora_001SuperBlackLockBit 3.0+3
