'Mora_001' ransomware gang exploiting Fortinet bug spotlighted by CISA in January

Researchers and US agencies have observed active exploitation of two Fortinet FortiGate vulnerabilities (CVE-2024-55591 and CVE-2025-24472) by a new ransomware operator, Mora_001, which deploys a LockBit-derived strain called SuperBlack; CISA and Fortinet issued advisories and patches as intrusions targeting exposed FortiGate management interfaces began in late January and continued into March.