The Mora_001 group uses similar post-exploitation patterns and ransomware customization originated by LockBit.
First seen on darkreading.com
Jump to article: www.darkreading.com/cyberattacks-data-breaches/actor-tied-lockbit-ransomware-targets-fortinet-users