New kids on the ransomware block channel Lockbit to raid Fortinet firewalls

Researchers identified a new ransomware operator called Mora_001 that leveraged two Fortinet authentication-bypass vulnerabilities to infiltrate devices, create stealthy admin accounts (including HA-synced backdoors and TACACS+/RADIUS-derived persistence), move laterally via SSH to high-value assets, exfiltrate data and deploy a LockBit-derived ransomware variant named SuperBlack; ties to LockBit include shared code and a retained qTox ID. Forescout highlights widespread exposed/unpatched Fortinet devices and recommends patching, auditing admin/VPN accounts, and disabling external management to mitigate the threat.