Hackers Exploit Fortinet Firewall Bugs to Deploy Ransomware

Hackers are actively exploiting vulnerabilities in Fortinet firewalls to deploy ransomware, targeting organizations that have yet to patch their systems. The Mora_001 ransomware gang, which has ties to the notorious LockBit group, has been using two specific Fortinet flaws — CVE-2024-55591 and CVE-2025-24472 — to break into corporate networks and deploy their ransomware variant, dubbed SuperBlack.

The vulnerabilities, affecting Fortinet's FortiGate firewall appliances, were first exploited in December 2024. While patches were released in January, many organizations remain vulnerable.

"The encryption was initiated only after data exfiltration, aligning with recent trends among ransomware operators who prioritize data theft over pure disruption," said Sai Molige, senior manager of threat hunting at Forescout, in an interview with TechCrunch.

Mora_001 is believed to have close ties to LockBit, one of the most infamous ransomware gangs. LockBit was disrupted by law enforcement in early 2024.

The SuperBlack ransomware strain was built using the leaked LockBit 3.0 builder, with its ransom note bearing similarities to those used by previous LockBit affiliates. "This connection could indicate that Mora_001 is either a current affiliate with unique operational methods or an associate group sharing communication channels," Molige explained.

Despite the urgency of the issue, many organizations have yet to apply the necessary security updates. “The threat actor tied to the ransomware campaign described by Forescout appears to be using a familiar set of tools seen in past ransomware activity while adapting their initial access techniques,” said Stefan Hostetler, head of threat intelligence at Arctic Wolf, in an interview with The Record.

Mora_001 is not the only threat actor taking advantage of the situation. As TechRadar notes, other potential affiliates of LockBit have already begun targeting businesses using the same Fortinet vulnerabilities, reinforcing concerns about the growing use of recycled malware tools and affiliate-based ransomware models.

Fortinet has yet to comment on the ongoing attacks, but cybersecurity researchers emphasize the urgent need for organizations to apply patches and secure their networks.