Full Report
Researchers from Forescout Technologies‘ Forescout Research – Vedere Labs identified a series of intrusions exploiting two Fortinet vulnerabilities... The post Forescout details SuperBlack ransomware exploiting critical Fortinet vulnerabilities appeared first on Industrial Cyber.
Analysis Summary
# Incident Report: Fortinet Vulnerability Exploitation Leading to SuperBlack Ransomware Deployment
## Executive Summary
Between late January and early March, threat actor Mora\_001 exploited two zero-day vulnerabilities (CVE-2024-55591 and CVE-2025-24472) in public-facing FortiGate firewall appliances to gain initial access. The intrusions rapidly progressed to the deployment of a novel ransomware strain, designated "SuperBlack," which shares similarities with LockBit 3.0. The incident highlights the collaboration complexities in the modern ransomware ecosystem and the critical need for immediate patching and strict access control on edge devices.
## Incident Details
- Discovery Date: Late January (Start of exploitation observed)
- Incident Date: Late January – Early March
- Affected Organization: Multiple organizations/environments targeted (Specific organizations not disclosed, remediation underway)
- Sector: Mixed (Inferred from general nature of external-facing firewall compromise)
- Geography: Global (Highest exposed firewalls in US, India, Brazil)
## Timeline of Events
### Initial Access
- **Date/Time:** Late January (Shortly after PoC exploit release on Jan 27)
- **Vector:** Exploitation of Fortinet firewall vulnerabilities (CVE-2024-55591 and CVE-2025-24472).
- **Details:** Attackers used two primary methods targeting unauthenticated access to gain "super\_admin" privileges on exposed FortiOS devices ($<7.0.16$):
1. **jsconsole:** Direct exploitation via the jsconsole interface, often spoofing common IP addresses.
2. **HTTPS:** Direct requests exploiting the same underlying vulnerability.
### Lateral Movement
- **Details:** Not explicitly detailed, but implied by the consistency of post-exploitation patterns: creation of identical usernames across victim networks, configuration backup behaviors, and rapid ransomware deployment (within 48 hours if security controls were weak).
### Data Exfiltration/Impact
- **Details:** Deployment of the **SuperBlack** ransomware strain, closely resembling LockBit 3.0 but using a custom exfiltration executable.
### Detection & Response
- **Details:** Identified by Forescout Research – Vedere Labs through analysis of firewall logs which were instrumental in reconstructing attack sequences. Response involves remediation and patching recommendations.
## Attack Methodology (Attributed to threat actor Mora\_001)
- **Initial Access:** Exploitation of Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472 (Unauthenticated privilege escalation).
- **Persistence:** Not explicitly detailed, but implied by consistent post-exploitation patterns.
- **Privilege Escalation:** Achieved "super\_admin" privileges on the firewall via exploit.
- **Defense Evasion:** Use of modified exploits and custom exfiltration tools (SuperBlack).
- **Credential Access:** Inferred through post-exploitation consistency (e.g., creation of identical usernames).
- **Discovery:** Inferred through configuration backup behaviors observed in compromised environments.
- **Lateral Movement:** Consistent post-exploitation patterns suggest structured playbook movement.
- **Collection:** Use of a custom data exfiltration executable specific to the SuperBlack variant.
- **Exfiltration:** Conducted using the actor's custom tool.
- **Impact:** Encryption of systems using the SuperBlack ransomware strain.
## Impact Assessment
- **Financial:** Not Quantified (Costs associated with remediation and downtime).
- **Data Breach:** Unknown type/volume, but linked to data exfiltration via a custom executable.
- **Operational:** Potential for significant operational disruption due to rapid ransomware deployment (within 48 hours in favorable conditions).
- **Reputational:** Not specified, but an active ransomware campaign involving newly identified malware strains creates reputational risk.
## Indicators of Compromise
*Note: Specific IoCs redacted as per investigation practice, but the types observed include:*
- **Network indicators:** Overlapping IP addresses used for initial access, post-exploitation, and C2 communications (partially tracked).
- **File indicators:** The custom data exfiltration executable used by Mora\_001.
- **Behavioral indicators:** Consistent creation of identical usernames across victims; rapid ransomware deployment; specific configuration backup changes; use of a LockBit TOX ID in the ransom note.
## Response Actions
- **Containment measures:** Not explicitly detailed, presumed to involve immediate firewall isolation or patching based on vulnerability disclosure.
- **Eradication steps:** Implied need to remove ransomware and any persistence mechanisms established by Mora\_001.
- **Recovery actions:** Restoring systems encrypted by the SuperBlack ransomware.
## Lessons Learned
- Publicly released Proof-of-Concept (PoC) exploits for critical vulnerabilities (like on Jan 27) lead to rapid, widespread exploitation (observed within 96 hours).
- Attack groups blend in the modern ransomware landscape; Mora\_001 shows an independent operational signature while maintaining links (e.g., TOX ID) to established groups like LockBit.
- Inadequate logging (especially CLI audit logs, HTTPS traffic logs, and comprehensive authentication auditing) significantly hinders investigation.
## Recommendations
1. **Patch Immediately:** Apply FortiOS updates addressing CVE-2024-55591 and CVE-2025-24472 immediately on all vulnerable FortiGate appliances.
2. **Restrict Management Access:** Disable external management access to firewalls whenever possible.
3. **Audit Accounts:** Review and remove unauthorized administrator and VPN accounts, paying attention to slight username variations.
4. **Review Automation:** Check for unauthorized automation tasks on networking devices.
5. **Enhance Logging:** Enable comprehensive logging: CLI audit logs on FortiGate, HTTP/S traffic logs, NPS auditing, and Authentication system auditing (recording successes and failures).