Hackers are exploiting Fortinet firewall bugs to plant ransomware

Protective researchers have seen a pair of hackers associated with the infamous lockbit gang to deploy ranswear to the networks of a number of hackers.

In A report published last weekFourScout Research Protection Researchers say that it is a group of tracking known as “Mora_001”, which is used by Fortinate Firewalls, which sits on the edge of a company’s network and acts as a digital gatekeeper, to refer to a “superblack” of a custom ransomware strain.

One of the weaknesses, as tracked as CV-2024-55591Has been used in cybertacks Fortinate Customers Violation of Corporate Networks From December 2024. Forkout says a second bug, it has been tracked CV-2025-24472Also being absorbed by Mora_001 on the attacks. Fortinate released the patch for both bugs in January.

Senior manager of the threat in the forkout told TechCrunch that the cybercast firm “has investigated three events in various organizations, but we believe that others may be.”

In a guaranteed intrusion, Forekout said it was observed by encrypting “by selecting” by selecting the attacker the sensitive data -containing file servers.

“The encryption was started only after the source of the data,” Molij said, “The recent tendency to prioritize data more than pure disruption,” Molij said.

Forexout says that Mora_001 Threatened actor “showed a distinct operational signature,” which the firm says that there is a “close relationship” with the Lockbith Ranswireware gang, Which was disrupted by US authorities last yearThe Molij said that the superblack ransomwear was based on the manufacturer behind the malware behind the Lockbeat 4.1 attack, while on the other hand a ransom note used by Mora_001 included the same messaging address used by Locbutt.

“This connection may indicate that mora_001 is either either unique operational methods or sharing a partner of a partner group communication channel,” said Molij.

The threat of the Cybercuity Farm Arctic Wolf is the Chief Stefan Hosteller, which Previously observed the absorption of CVE -2024-55591Takecches informed that Forexout searchs recommend that hackers are following the remaining companies who were unable to apply the patch or were unable to tighten their firewall configurations when the weakness was originally expressed. “

The hostel says that the ransom note used in these attacks is similar to other groups, Such as now the degraded Alfvvi/Blackcat Ransomware gangThe

Fortinate did not answer TechCrunch’s question.