Tag: CVE-2024-55591

6 Attack Reports | 1 Vulnerabilities

Attack reports

The Gentleman Ransomware | Defense Evasion TTPs Uncovered

In April and May 2026, investigations revealed two incidents involving The Gentlemen ransomware-as-a-service operation, which has claimed over 400 victims across 70 countries since mid-2025. Both incidents demonstrated common tactics including Scheduled Tasks, PowerShell commands, and defense evasi…

ransomware-as-a-service

defense evasion

scheduled tasks

event log clearing

microsoft defender tampering

trojan:win32/mptamperbulkexcl.h

Published: May 21, 2026

Linked vulnerabilities : CVE-2024-55591 (CVSS 9.8)

Downloadable IOCs: 3

Thus Spoke…The Gentlemen

On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet a…

ransomware-as-a-service

affiliate-program

Published: May 13, 2026

Linked vulnerabilities : CVE-2024-55591 (CVSS 9.8), CVE-2025-32433 (CVSS 10.0), CVE-2025-33073 (CVSS 8.8)

Downloadable IOCs: 33

An Overview of The Gentlemen's TTPs

This intelligence report provides a comprehensive analysis of The Gentlemen, a ransomware group known for its sophisticated tactics, techniques, and procedures (TTPs). The group exploits vulnerabilities in FortiOS/FortiProxy, maintains a database of compromised devices, and employs advanced defense…

credential-theft

data-exfiltration

lateral-movement

defense-evasion

Published: March 20, 2026

Linked vulnerabilities : CVE-2024-37085 (CVSS 6.8), CVE-2024-55591 (CVSS 9.8), CVE-2023-27532, CVE-2025-32463 (CVSS 9.3)

Downloadable IOCs: 4

MuddyWater Exposed: Inside an Iranian APT operation

Researchers identified and analyzed exposed infrastructure of MuddyWater, an Iranian cyber espionage group linked to the Ministry of Intelligence and Security. The investigation revealed their reconnaissance methods, exploitation of vulnerabilities, custom command and control frameworks, and exfilt…

cyber espionage

vulnerability exploitation

command and control

tsundere botnet

geopolitical conflict

Published: March 5, 2026

Linked vulnerabilities : CVE-2024-5559 (CVSS 6.1), CVE-2024-55591 (CVSS 9.8), CVE-2022-42475, CVE-2025-5777 (CVSS 9.3), CVE-2025-54068 (CVSS 9.2), CVE-2025-9316 (CVSS 6.9), CVE-2025-55182 (CVSS 10.0), CVE-2025-34291 (CVSS 9.4), CVE-2025-68613 (CVSS 9.9), CVE-2025-52691 (CVSS 10.0), CVE-2026-1281 (CVSS 9.8), CVE-2026-1731 (CVSS 9.9), CVE-2024-23113

Downloadable IOCs: 14

Mass Scanning and Exploit Campaigns

Trustwave SpiderLabs has identified ongoing malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns. The investigation revealed connections between Proton66 and bulletproof hosting services advertised on underground forums. Mass…

vulnerability exploitation

bulletproof hosting

exploit campaigns

critical vulnerabilities

underground forums

Published: May 16, 2025

Linked vulnerabilities : CVE-2024-41713 (CVSS 7.5), CVE-2024-10914 (CVSS 8.1), CVE-2024-55591 (CVSS 9.8), CVE-2025-24472 (CVSS 8.1), CVE-2025-0108 (CVSS 9.1)

Downloadable IOCs: 22

New Ransomware Operator Exploits Fortinet Vulnerability Duo

A new ransomware operator, dubbed Mora_001, has been exploiting Fortinet firewall vulnerabilities CVE-2024-55591 and CVE-2025-24472 to gain unauthorized access and deploy a modified version of LockBit ransomware. The threat actor creates persistent admin accounts, exfiltrates firewall configuration…

lateral movement

data exfiltration

Published: March 14, 2025

Downloadable IOCs: 23

Click here to see more Attack Reports

Vulnerabilities

CVE-2024-55591

Fortiproxy
Fortios

Published: January 14, 2025

Click here to see more Vulnerabilities