[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqhBjAMmUuNvK8qyeTEaG9ce5-WPBIY3IM6erzT5AJj0":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":11,"target_industries":12,"target_countries":13,"incident_types":14,"references":15,"techniques":17,"technique_count":18,"created_at":19,"seoMetadata":20,"schemaOrg":24},"Mora_001","mora-001",[],"Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The actor has been observed exploiting CVE-2024-55591 and CVE-2025-24472 vulnerabilities affecting Fortinet devices. The ransom note associated with Mora_001 includes the same TOX ID used by LockBit, indicating a potential affiliation or shared communication channels. Their post-exploitation patterns suggest a structured playbook that differentiates them from other ransomware operators, including LockBit affiliates.","RU",null,[],[],[],[16],"https:\u002F\u002Fwww.forescout.com\u002Fblog\u002Fnew-ransomware-operator-exploits-fortinet-vulnerability-duo\u002F",[],0,"2025-03-21T02:15:06.521299+00:00",{"title":21,"metaDescription":22,"keywords":23},"Mora_001 Threat Actor Profile | EdgeProtect","Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The act...","Mora_001, threat actor, APT, cyber threat, threat intelligence, RU",{"@context":25,"@type":26,"name":6,"alternateName":27,"description":9,"url":28,"mainEntityOfPage":29,"location":31},"https:\u002F\u002Fschema.org","Organization",[],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fmora-001",{"@type":30,"@id":28},"WebPage",{"@type":32,"name":10},"Country"]