Threat Actor Tied to LockBit Ransomware Targets Fortinet Users

Since January, researchers report a threat actor dubbed Mora_001 is exploiting two Fortinet vulnerabilities (CVE-2024-55591 and CVE-2025-24472) to gain super-administrator access to FortiOS/FortiProxy devices and deploy SuperBlack ransomware; researchers note Russian-language artifacts and possible ties to the LockBit ecosystem and urge organizations—particularly those with exposed FortiGate firewalls—to patch, restrict management access, audit accounts, and enable comprehensive logging.