Loading threat actor…
Mora_001 is a Russian-origin threat actor associated with initial access operations against internet-exposed edge infrastructure and with subsequent ransomware deployment under the SuperBlack name. The actor has been linked to exploitation of Fortinet FortiOS vulnerabilities, including CVE-2024-55591 and CVE-2025-24472, to obtain unauthenticated super_admin access on vulnerable FortiGate devices. Reporting also ties the actor to the broader LockBit ecosystem: SuperBlack is assessed as a customized variant resembling LockBit 3.0, and the actor has been described as distinct from but operationally connected to LockBit-affiliated activity. Mora_001 exhibits a repeatable intrusion pattern. After compromising perimeter devices, the actor establishes persistence by creating administrative and VPN-capable accounts, including lookalike usernames, and by using automation features to recreate privileged access. The actor performs reconnaissance through firewall dashboards and configuration theft, then uses the recovered network, policy, routing, key, and VPN information to identify high-value internal systems. Observed lateral movement and remote execution methods include WMIC and SSH, with targeting focused on file servers, authentication infrastructure, domain controllers, database servers, and other critical infrastructure devices. The actor has been associated with brute-force tooling used against edge authentication technologies, including Fortinet, Cisco, Citrix, Pulse Secure, GlobalProtect, RDWeb, OWA, and F5 BIG-IP. This supports assessment of Mora_001 as an initial access broker or access-focused operator that blends opportunistic exploitation, credential attacks, and post-compromise expansion. The tooling and tradecraft include proxy rotation, continued credential attacks after successful authentication, and anti-detection features such as honeypot scanning. In ransomware cases, Mora_001 has conducted data theft prior to encryption and has selectively encrypted file servers rather than always encrypting entire environments, consistent with double-extortion operations. A related wiper component, WipeBlack, has been used to remove evidence of ransomware execution. Separate reporting from February 2026 indicates activity attributed to Mora_001 also evolved beyond straightforward ransomware deployment toward strategic espionage-oriented intrusions, with use of Matanbuchus 3.0, Astarion RAT, and SystemBC. Known aliases are limited to Mora_001.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
63 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.