Archive — US — techcrunch
Hackers are exploiting Fortinet firewall bugs to plant ransomware
Hackers linked to the LockBit gang are exploiting Fortinet firewall vulnerabilities (CVE-2024-55591 and CVE-2025-24472) to deploy a ransomware strain known as SuperBlack. Security researchers from Forescout highlighted that attacks began in December 2024, with the threat actor dubbed 'Mora_001' targeting sensitive corporate data after exfiltrating it. Fortinet's patches were released in January, but not all companies applied them.
Key points
- Vulnerabilities CVE-2024-55591 and CVE-2025-24472 are exploited by attackers linked to Mora_001.
- Attacks have targeted multiple corporate networks since December 2024, leading to ransomware deployment.
- Forescout noted that data encryption occurred only after exfiltration, indicating a trend among ransomware operators.
- SuperBlack ransomware utilizes methods derived from LockBit 3.0 malware developments.
- Evidence suggests Mora_001 operates closely with the LockBit gang, indicating a potential affiliate relationship.
- Fortinet issued patches for the vulnerabilities in January, but many companies failed to implement them.
Why it matters
- The rise in ransomware attacks correlates with increasing cyber threats faced by organizations globally.
- Fortinet has previously been targeted due to its widespread use among corporations, making it a prime target.
- The LockBit ransomware group has previously faced law enforcement actions, yet its methods persist in other affiliated groups.
- There is a growing trend in cybersecurity surrounding data exfiltration prior to encryption, seen in attacks from other groups like ALPHV/BlackCat.
The exploitation of Fortinet vulnerabilities by the Mora_001 group exemplifies the ongoing threat of ransomware, particularly for organizations that neglect timely security updates, underscoring the importance of proactive cybersecurity measures in today's digital landscape.