Loading threat actor…
Mora_001 is a Russian-origin threat actor associated with initial access operations against internet-exposed edge infrastructure and with subsequent ransomware deployment under the SuperBlack name. The actor has been linked to exploitation of Fortinet FortiOS vulnerabilities, including CVE-2024-55591 and CVE-2025-24472, to obtain unauthenticated super_admin access on vulnerable FortiGate devices. Reporting also ties the actor to the broader LockBit ecosystem: SuperBlack is assessed as a customized variant resembling LockBit 3.0, and the actor has been described as distinct from but operationally connected to LockBit-affiliated activity. Mora_001 exhibits a repeatable intrusion pattern. After compromising perimeter devices, the actor establishes persistence by creating administrative and VPN-capable accounts, including lookalike usernames, and by using automation features to recreate privileged access. The actor performs reconnaissance through firewall dashboards and configuration theft, then uses the recovered network, policy, routing, key, and VPN information to identify high-value internal systems. Observed lateral movement and remote execution methods include WMIC and SSH, with targeting focused on file servers, authentication infrastructure, domain controllers, database servers, and other critical infrastructure devices. The actor has been associated with brute-force tooling used against edge authentication technologies, including Fortinet, Cisco, Citrix, Pulse Secure, GlobalProtect, RDWeb, OWA, and F5 BIG-IP. This supports assessment of Mora_001 as an initial access broker or access-focused operator that blends opportunistic exploitation, credential attacks, and post-compromise expansion. The tooling and tradecraft include proxy rotation, continued credential attacks after successful authentication, and anti-detection features such as honeypot scanning. In ransomware cases, Mora_001 has conducted data theft prior to encryption and has selectively encrypted file servers rather than always encrypting entire environments, consistent with double-extortion operations. A related wiper component, WipeBlack, has been used to remove evidence of ransomware execution. Separate reporting from February 2026 indicates activity attributed to Mora_001 also evolved beyond straightforward ransomware deployment toward strategic espionage-oriented intrusions, with use of Matanbuchus 3.0, Astarion RAT, and SystemBC. Known aliases are limited to Mora_001.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Initial Access and Persistence CVE-2024-55591 and CVE-2025-24472 allow unauthenticated attackers to gain super_admin privileges on vulnerable FortiOS devices (<7.0.16) with exposed management interfaces. A proof-of-concept (PoC) exploit was publicly released on January 27, and within 96 hours, we observed active exploitation in the wild using two distinct methods: jsconsole ... HTTPS ...
Initial Access and Persistence CVE-2024-55591 and CVE-2025-24472 allow unauthenticated attackers to gain super_admin privileges on vulnerable FortiOS devices (<7.0.16) with exposed management interfaces... Another common exploitation method we observed involved the threat actor using the fortigate-firewall account to exploit CVE-2025-24472 rather than CVE-2024-55591.
63 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a ransomware campaign in which the VPN Brute infrastructure/tooling was observed.
Threat actor linked (by Forescout) to exploitation of Fortinet FortiOS vulnerabilities resulting in deployment of SuperBlack ransomware; infrastructure overlap noted with Proton66-associated IP activity.
Mora_001 is an initial access broker attributed with exploiting Fortinet FortiOS vulnerabilities to deliver the SuperBlack ransomware.
Conducts intrusions via exploitation of FortiGate/FortiOS perimeter devices, establishes persistence (e.g., creating VPN users), performs reconnaissance and lateral movement (WMIC/SSH), exfiltrates data, and deploys a customized ransomware variant (“SuperBlack”) resembling LockBit 3.0; selectively encrypts high-value systems (notably file servers) after exfiltration.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.