Full Report
Trustwave SpiderLabs continuously tracks a range of malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns leading to malware infections.
Analysis Summary
# Tool/Technique: SuperBlack Ransomware
## Overview
SuperBlack is a new strain of ransomware deployed following the exploitation of Fortinet FortiOS authentication bypass vulnerabilities. It closely resembles the LockBit 3.0 ransomware variant but features a distinct ransom note and a custom data exfiltration executable.
## Technical Details
- Type: Malware Family (Ransomware)
- Platform: Likely Windows (inferred from similarity to LockBit 3.0)
- Capabilities: Data encryption and ransomware operations, including custom data exfiltration.
- First Seen: Context implies recent activity coinciding with the exploitation of CVE-2024-55591 and CVE-2025-24472.
## MITRE ATT&CK Mapping
The core functionality of deploying and executing ransomware maps to the Impact tactic.
- **TA0040 - Impact**
- **T1486 - Data Encrypted for Impact**
- *Note: Specific sub-techniques depend on the exact encryption/disabling methods used, but T1486 is the primary mapping.*
## Functionality
### Core Capabilities
- Encrypting victim data to hold for ransom.
- Leaving a customized ransom note (different from LockBit 3.0).
### Advanced Features
- Includes a **custom data exfiltration executable**, suggesting data theft (double extortion) prior to or during encryption.
- Close structural resemblance to LockBit 3.0, suggesting use of established ransomware coding frameworks.
## Indicators of Compromise
- File Hashes: [Not explicitly provided in the summary]
- File Names: [Not explicitly provided in the summary]
- Registry Keys: [Not explicitly provided in the summary]
- Network Indicators: [Not explicitly provided in the summary]
- Behavioral Indicators: [Behavior consistent with post-exploitation ransomware deployment following FortiOS vulnerability exploitation.]
## Associated Threat Actors
- Associated with the initial access broker/operator dubbed **“Mora\_001”**.
## Detection Methods
- Signature-based detection: Utilizing signatures derived from the custom ransom note or the unique data exfiltration executable.
- Behavioral detection: Monitoring for file system access patterns indicative of bulk encryption and attempted data staging/exfiltration.
- YARA rules: [Not available based on provided context]
## Mitigation Strategies
- Patching Fortinet FortiOS devices immediately to address **CVE-2024-55591** and **CVE-2025-24472**.
- Implementing strong network segmentation and access controls.
- Monitoring for unauthorized data egress attempts.
## Related Tools/Techniques
- LockBit 3.0 (Close structural resemblance)
***
# Tool/Technique: Fortinet FortiOS Authentication Bypass (CVE-2024-55591 and CVE-2025-24472)
## Overview
A pair of critical authentication bypass vulnerabilities affecting Fortinet FortiOS-based devices that are being actively exploited for initial access leading to the deployment of SuperBlack ransomware.
## Technical Details
- Type: Vulnerability (Exploit Chain)
- Platform: Fortinet FortiOS
- Capabilities: Allowing unauthorized access and potentially remote command execution following successful authentication bypass.
- First Seen: Activity observed between January and March (implied 2024).
## MITRE ATT&CK Mapping
These vulnerabilities are used for initial access to target networks.
- **TA0001 - Initial Access**
- **T1190 - Exploit Public-Facing Application**
## Functionality
### Core Capabilities
- Bypassing existing authentication mechanisms on FortiOS devices.
### Advanced Features
- Used as the primary method for network intrusion by the "Mora\_001" operator.
## Indicators of Compromise
- File Hashes: [Not explicitly provided in the summary]
- File Names: [Not explicitly provided in the summary]
- Registry Keys: [Not applicable, affects network appliance firmware/OS]
- Network Indicators: Malicious scanning and exploit traffic observed originating from the IP address **193[.]143[.]1[.]65**.
- Behavioral Indicators: Exploitation attempts targeting the vulnerable FortiOS services.
## Associated Threat Actors
- **“Mora\_001”** (Initial Access Broker/Operator)
## Detection Methods
- Signature-based detection: Specific signatures for exploit payloads related to CVE-2024-55591 and CVE-2025-24472.
- Behavioral detection: Detection of unusual authentication sequences or high-volume traffic directed at vulnerable FortiOS services.
- YARA rules: [Not available based on provided context]
## Mitigation Strategies
- Immediately apply vendor-released patches for **CVE-2024-55591** and **CVE-2025-24472**.
- Restrict external access to administrative interfaces on FortiOS devices, using multi-factor authentication (MFA) where possible.
## Related Tools/Techniques
- SuperBlack Ransomware (Payload deployed post-exploitation)
***
# Tool/Technique: Scanning and Exploit Activity by "Mora\_001"
## Overview
Systematic scanning, brute forcing, and exploit attempts conducted by the actor "Mora\_001" primarily targeting Fortinet appliances to gain initial access.
## Technical Details
- Type: Technique/Activity Set
- Platform: Targeting network perimeter devices (e.g., VPNs, management interfaces running FortiOS)
- Capabilities: Mapping potential targets, credential testing, and executing known exploits against public-facing infrastructure.
- First Seen: Activity monitored between January and March.
## MITRE ATT&CK Mapping
This activity covers reconnaissance, resource development, and initial access phases.
- **TA0043 - Reconnaissance**
- **T1595 - Active Scanning**
- **T1595.001 - Active Scanning**
- **TA0009 - Collection** (If configuration data is gathered)
- **TA0001 - Initial Access**
- **T1190 - Exploit Public-Facing Application**
## Functionality
### Core Capabilities
- Mass scanning for internet-facing services.
- Brute force attempts against authentication mechanisms.
- Execution of exploits targeting critical vulnerabilities (specifically FortiOS mentioned).
### Advanced Features
- Targeted sector selection: Observed disproportionate targeting of **non-profit, engineering, and financial sectors**.
## Indicators of Compromise
- File Hashes: [Not explicitly provided in the summary]
- File Names: [Not explicitly provided in the summary]
- Registry Keys: [Not applicable]
- Network Indicators: Source IP address **193[.]143[.]1[.]65** associated with scanning and exploit traffic.
- Behavioral Indicators: High rate of connection attempts, failed login attempts, and traffic matching exploit patterns for the targeted vulnerabilities.
## Associated Threat Actors
- **“Mora\_001”**
## Detection Methods
- Signature-based detection: Signatures for specific port/service scanning or known exploit payloads.
- Behavioral detection: Rate-limiting alerts for excessive connection attempts originating from single IPs, and alerts for authentication failures.
- YARA rules: [Not available based on provided context]
## Mitigation Strategies
- Implement Web Application Firewalls (WAF) or Intrusion Prevention Systems (IPS) configured to block known scanning and exploit attempt patterns.
- Apply strict egress filtering on firewalls.
- Deploy robust log monitoring for external connection attempts.
## Related Tools/Techniques
- Exploitation of CVE-2024-55591 and CVE-2025-24472
- SuperBlack Ransomware (As the subsequent payload)