Mora_001

Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The actor has been observed exploiting CVE-2024-55591 and CVE-2025-24472 vulnerabilities affecting Fortinet devices. The ransom note associated with Mora_001 includes the same TOX ID used by LockBit, indicating a potential affiliation or shared communication channels. Their post-exploitation patterns suggest a structured playbook that differentiates them from other ransomware operators, including LockBit affiliates.

Qrupun mənşəyi Rusiya kimi bildirilir.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/

Mənbə: MISP Galaxy, Malpedia.