SuperBlack
SuperBlack is a rising ransomware threat group/strain observed in 2025. Reporting links it to exploitation of Fortinet FortiOS/FortiProxy CVE-2024-55591 for initial access, and VulnCheck listed SuperBlack among six named ransomware families associated with that vulnerability. Trustwave SpiderLabs reported that IP address 193.143.1.65 was connected to operators of the SuperBlack ransomware strain and linked the activity to Proton66, a Russian bulletproof hosting provider (ASN 198953). SpiderLabs also stated that SuperBlack operators were distributing recent critical-priority exploits. The group has been reported as preferring non-profit, engineering, and financial sectors. Forescout linked the same IP to the Mora_001 threat actor exploiting Fortinet FortiOS vulnerabilities to deploy SuperBlack ransomware. Based on the provided content, SuperBlack is associated with ransomware operations leveraging edge-device exploitation, particularly Fortinet appliances, and infrastructure tied to Proton66. No additional aliases or sub-groups beyond the name SuperBlack are directly supported in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ransomware family associated with exploitation of Fortinet FortiOS CVE-2024-55591 in 2025 ransomware activity.
Rising ransomware group; associated with exploitation of Fortinet FortiProxy.
Ransomware operators leveraging Proton66 bulletproof hosting infrastructure; associated with mass scanning/brute-force/exploitation activity and distribution of recent critical exploits. Reported to target non-profit, engineering, and financial sectors.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.