Mora_001
Mora_001 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 5 MITRE ATT&CK techniques.
- Techniques
- 5
- Exploited CVEs
- No CVE data
- Record updated
About Mora_001.
Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The actor has been observed exploiting CVE- and CVE- vulnerabilities affecting Fortinet devices. The ransom note associated with Mora_001 includes the same TOX ID used by LockBit, indicating a potential affiliation or shared communication channels. Their post-exploitation patterns suggest a structured playbook that differentiates them from other ransomware operators, including LockBit affiliates.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.