Loading malware…
SuperBlack is a ransomware strain deployed in intrusions that begin with exploitation of Fortinet FortiOS and FortiGate authentication-bypass vulnerabilities, notably CVE-2024-55591 and CVE-2025-24472. It has been linked to a threat actor tracked as Mora_001 and is assessed to have ties to the LockBit ecosystem. SuperBlack closely resembles LockBit 3.0 (LockBit Black), with reported differences centered on modified ransom-note content and a custom data-exfiltration component, suggesting use of a leaked LockBit builder with operator-specific customization.
Observed SuperBlack operations target internet-exposed Fortinet appliances to obtain administrative access, establish persistence through newly created administrative or VPN-capable accounts, and conduct reconnaissance using firewall configuration data and management dashboards. After gaining a foothold, operators move laterally to high-value systems including file servers, authentication infrastructure, domain controllers, and database servers, using techniques such as WMIC and SSH. In confirmed cases, the operation prioritized data theft before encryption and selectively encrypted file servers rather than indiscriminately encrypting entire environments, consistent with double-extortion ransomware tradecraft.
Victimology associated with SuperBlack includes non-profit, engineering, and financial organizations, with broader reporting also tying activity to attacks against technology-focused targets through related infrastructure. The campaign has been notable for rapid post-compromise execution when conditions are favorable, though operators have also demonstrated longer reconnaissance phases in more defended environments. Reporting also associates the activity with a companion wiper component, WipeBlack, used to remove evidence of ransomware execution and support defense evasion. Overall, SuperBlack represents a Fortinet-exploitation-driven ransomware operation combining opportunistic edge-device compromise, persistence on network infrastructure, lateral movement into core enterprise assets, data exfiltration, and selective encryption.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
It began with the exploitation of Fortigate firewall appliances — culminating in the deployment of a newly discovered ransomware strain we have dubbed SuperBlack. ... The ransomware strain observed in these incidents closely resembles LockBit 3.0 (LockBit Black). The primary differences lie in the ransom note left after encryption and a custom data exfiltration executable. Due to these modifications, we have designated this variant “SuperBlack”.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
“When the firewall had VPN capabilities, the threat actor created local VPN user accounts with names resembling legitimate accounts but with an added digit at the end… added to the VPN user group, enabling future logins… manually assigned a password…”
CVE-2024-55591 and CVE-2025-24472 allow unauthenticated attackers to gain super_admin privileges on vulnerable FortiOS devices (<7.0.16) with exposed management interfaces.
The actor primarily relied on Windows Management Instrumentation (WMIC) for remote system discovery and execution.
“When the firewall had VPN capabilities, the threat actor created local VPN user accounts with names resembling legitimate accounts but with an added digit at the end… added to the VPN user group, enabling future logins… manually assigned a password…”
“When the firewall had VPN capabilities, the threat actor created local VPN user accounts with names resembling legitimate accounts but with an added digit at the end… added to the VPN user group, enabling future logins… manually assigned a password…”
The wiper file is designed to remove evidence of the ransom executable after encryption.
“When the firewall had VPN capabilities, the threat actor created local VPN user accounts with names resembling legitimate accounts but with an added digit at the end… added to the VPN user group, enabling future logins… manually assigned a password…”
"...mass scanning, credential brute-forcing, and exploitation attempts..." and "...patterns like consistent brute-force attempts still matter."
"...a major increase in 'mass scanning, credential brute-forcing, and exploitation attempts' coming from Proton66’s network..."
The actor primarily relied on Windows Management Instrumentation (WMIC) for remote system discovery and execution, and SSH to access additional systems, particularly servers and network devices.
The actor primarily relied on Windows Management Instrumentation (WMIC) for remote system discovery and execution, and SSH to access additional systems, particularly servers and network devices.
The encryption was initiated only after data exfiltration, aligning with recent trends among ransomware operators who prioritize data theft over pure disruption.
It began with the exploitation of Fortigate firewall appliances — culminating in the deployment of a newly discovered ransomware strain we have dubbed SuperBlack.
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.