{"id":10415,"date":"2025-03-17T16:34:39","date_gmt":"2025-03-17T16:34:39","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/fortinet-firewall-bugs-exploited-for-ransomware\/"},"modified":"2025-03-17T16:34:39","modified_gmt":"2025-03-17T16:34:39","slug":"fortinet-firewall-bugs-exploited-for-ransomware","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/fortinet-firewall-bugs-exploited-for-ransomware\/","title":{"rendered":"Fortinet firewall bugs exploited for ransomware"},"content":{"rendered":"\n<\/p>\n
\n

Researchers specializing in security have identified a group of hackers affiliated with the notorious LockBit gang, who are exploiting two vulnerabilities in Fortinet firewalls to install ransomware on the networks of several companies.<\/p>\n

According to a recent report<\/a> by Forescout Research, a group known as “Mora_001” is taking advantage of these vulnerabilities in Fortinet firewalls, which serve as the digital entry points to a company’s network, to gain access and deploy a customized ransomware strain called “SuperBlack.”<\/p>\n

One of the exploited vulnerabilities, identified as CVE-2024-55591<\/a>, has been used in cyberattacks to compromise the networks of Fortinet customers<\/a> since December 2024. Forescout notes that a second vulnerability, tracked as CVE-2025-24472<\/a>, is also being exploited by Mora_001 in these attacks. Patches for both vulnerabilities were released by Fortinet in January.<\/p>\n

Sai Molige, senior manager of threat hunting at Forescout, informed TechCrunch that the cybersecurity firm has investigated three separate incidents at different companies but suspects there may be additional cases. <\/p>\n

In a confirmed incident, Forescout observed the attacker selectively encrypting file servers that contained sensitive data. <\/p>\n

Molige noted, “The encryption was only initiated after the exfiltration of data, which aligns with the recent trends among ransomware operators who prioritize data theft over disruption.” <\/p>\n

Forescout indicates that the Mora_001 threat actor exhibits a distinct operational pattern, which the firm believes has close ties to the LockBit ransomware gang, which was disrupted by U.S. authorities last year<\/a>. Molige explained that the SuperBlack ransomware is based on the leaked builder used in LockBit 3.0 attacks, and the ransom note used by Mora_001 includes the same messaging address used by LockBit. <\/p>\n

Molige added, “This connection could suggest that Mora_001 is either a current affiliate with unique methods or an associate group sharing communication channels.” <\/p>\n

Stefan Hostetler, Arctic Wolf’s head of threat intelligence, which previously observed exploitation of CVE-2024-55591<\/a>, told TechCrunch that Forescout’s findings imply hackers are targeting organizations that failed to apply the patch or harden their firewall configurations when the vulnerability was initially disclosed. <\/p>\n

Hostetler noted that the ransom note used in these attacks bears similarities to those used by other groups, such as the now-defunct ALPHV\/BlackCat ransomware gang<\/a>. <\/p>\n

Fortinet did not respond to TechCrunch’s inquiries. <\/p>\n<\/div>\n\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers specializing in security have identified a group of hackers affiliated with the notorious LockBit gang, who are exploiting two vulnerabilities in Fortinet firewalls to install ransomware on the networks…<\/p>\n","protected":false},"author":0,"featured_media":10416,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47],"tags":[143,3331,866,338,832],"class_list":["post-10415","post","type-post","status-publish","format-standard","has-post-thumbnail","category-news","tag-cybersecurity","tag-fortinet","tag-ransomware","tag-security","tag-vulnerability"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/scanning-computer-group.jpg","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=10415"}],"version-history":[{"count":0,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/10415\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/10416"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=10415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=10415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=10415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}