Image courtesy by QUE.com
In August 2026, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and international partners issued a joint cybersecurity advisory warning about a rapidly escalating ransomware threat known as Gunra. This ransomware-as-a-service (RaaS) operation has been systematically exploiting known vulnerabilities in Fortinet firewall and VPN appliances to breach government networks, healthcare systems, and critical infrastructure across multiple continents.
What Is the Gunra Ransomware?
Gunra first emerged in April 2025 as a sophisticated double-extortion ransomware variant derived from the leaked Conti ransomware source code. The Conti source code was publicly leaked in 2022, and since then, multiple threat groups have repurposed it to build new ransomware strains. Gunra represents one of the most successful and dangerous evolutions of this codebase.
By January 2026, Gunra had expanded into a formal RaaS affiliate program advertised on dark web forums. The group adopted the branding alias Golden Community and began recruiting penetration testers and ethical hackers as initial access brokers, offering them a share of ransom profits in exchange for enterprise network access. This professionalized affiliate model has enabled Gunra to scale its attacks far beyond what a single threat group could achieve alone.
The ransomware employs a double-extortion model: attackers first exfiltrate sensitive victim data, then encrypt the victim's systems. If the ransom is not paid within five to seven days, the actors threaten to publish the stolen data on their dedicated leak site (DLS) hosted on the Tor network. This approach puts maximum pressure on victims, who face both operational disruption from encryption and the reputational and regulatory damage of a public data breach.
How Gunra Breaches Networks
According to the FBI's technical analysis, Gunra actors primarily gain initial access by exploiting known vulnerabilities in internet-facing devices. The two critical CVEs identified in the advisory are:
- CVE-2024-55591 — An authentication bypass vulnerability affecting specific FortiOS and FortiProxy versions that allows attackers to create a malicious persistent user account with super-user privileges.
- CVE-2025-24472 — Another authentication bypass vulnerability in FortiOS and FortiProxy that enables unauthorized administrative access to firewall management interfaces.
Both vulnerabilities allow threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a new, malicious user called forticloud-sync with super-user privileges and a hard-coded password. This account gives attackers persistent administrative access to the firewall, which they then use as a gateway into the victim's internal network.
The Republic of Korea's National Police Agency (KNPA) also observed Gunra actors exploiting credential-exposure and SSH access control vulnerabilities in internet-facing VPN gateways. In one documented case, attackers gained access to an SSL-VPN administrative account by exploiting default credentials when account lockout controls were not enabled.
The Attack Chain: From Breach to Encryption
Once Gunra actors gain initial access, they follow a methodical attack chain mapped to the MITRE ATT&CK framework:
Lateral Movement and Credential Theft
Gunra actors use Impacket libraries — specifically psexec.py and smbclient.py — to move laterally across victim networks using the Server Message Block (SMB) protocol. They target Active Directory domain controllers and use secretsdump.py to extract password hashes from NTDS files, enabling pass-the-hash and pass-the-ticket attacks for deeper network penetration.
In one alarming case, Gunra actors manipulated the network traffic control functionality of an SSL-VPN appliance to capture credentials and session information transmitted by users authenticating to a corporate Virtual Desktop Infrastructure (VDI) portal. The actors then used stolen session cookies to conduct session hijacking, impersonating legitimate users to access the internal network.
MFA Bypass Technique
Perhaps the most sophisticated technique in Gunra's arsenal is its ability to bypass multi-factor authentication. The actors modified authentication processing files on a corporate VDI authentication portal server so that a specific, Gunra-designated one-time password (OTP) value would always be accepted. This created a persistent backdoor that allowed the attackers to authenticate regardless of the actual MFA challenge, effectively neutralizing one of the most common security controls organizations rely on.
Data Exfiltration at Scale
Before deploying encryption, Gunra actors exfiltrate massive volumes of data. The FBI observed actors using a custom malicious executable called main.exe to steal data from Microsoft OneDrive and SharePoint environments. In at least one case, attackers compressed sensitive data using 7-Zip and WinRAR, then exfiltrated the archives to the file-sharing service Mega. The volume of exfiltrated data reached tens of terabytes in some instances.
Common open-source tools found on Gunra infrastructure include FileZilla for FTP exfiltration, RClone for cloud storage management, and DBeaver for database access. The actors also use legitimate remote management tools like AnyDesk and Google Remote Desktop for persistence.
Encryption and Impact
Gunra's encryption engine is multi-threaded, supporting parallel encryption of multiple files simultaneously using ChaCha20 + RSA-4096 encryption — a combination that provides both speed and cryptographic strength. The binary encrypts files and appends the .ENCRT extension, then drops a ransom note named R3ADM3.txt in each affected directory.
To prevent system recovery, Gunra actors delete volume shadow copies using Windows Management Instrumentation (WMI) commands. In one documented case, they went further — deleting backup and archived data stored at both the primary data center and the disaster recovery center before and after ransomware deployment.
The ransomware binary also includes anti-analysis features. It uses the IsDebuggerPresent API to detect debugging environments and strategically times malicious activities to late-night and early-morning hours (10:00 PM to 6:00 AM) to avoid detection by network administrators.
Sectors Under Attack
Gunra's victim list spans organizations across the Americas, Europe, Middle East, Africa, and the Asia-Pacific. The targeted sectors include:
- Healthcare and public health
- Financial services and insurance
- Critical manufacturing and construction
- Transportation systems and logistics
- Government services and facilities
- Utilities and energy infrastructure
- Academic and educational institutions
- Media and communications
- Retail and professional services
The breadth of targeting demonstrates that Gunra is not opportunistic — its affiliates deliberately seek out high-value targets where operational downtime creates maximum pressure to pay. Critical infrastructure operators are particularly vulnerable because service disruptions can have cascading effects on public safety and economic stability.
A Glimmer of Hope: Linux Variant Weakness
In a significant development for defenders, researchers identified a critical weakness in Gunra's Linux ELF variants (files appended with .GNRA). The encryption keys in these variants use a weak pseudorandom number generator seeded with the predictable srand(time(NULL)) function. This means defenders can potentially reconstruct the encryption keys using file timestamps and recover files without paying the ransom — a rare breakthrough in the fight against ransomware.
How to Protect Your Organization
The joint advisory provides specific mitigation recommendations aligned with CISA's Cross-Sector Cybersecurity Performance Goals (CPGs):
1. Patch Known Vulnerabilities Immediately
The single most critical action is to patch known exploited vulnerabilities in internet-facing systems. Specifically, organizations using Fortinet FortiOS or FortiProxy should immediately apply patches for CVE-2024-55591 and CVE-2025-24472. All operating systems, software, and firmware should be kept current.
2. Implement Immutable Backups
Organizations must implement and test offline, immutable backups stored in physically separate, segmented locations. These backups should be inaccessible from the primary network to prevent ransomware actors from deleting them during an attack. Regular recovery testing ensures that backups are viable when needed.
3. Segment Networks
Network segmentation restricts lateral movement by controlling traffic flows between subnetworks. By isolating critical systems from general-purpose networks, organizations can contain an intrusion and prevent ransomware from spreading across the entire environment.
4. Enforce Multi-Factor Authentication
While Gunra has demonstrated MFA bypass capabilities, multi-factor authentication still significantly raises the bar for attackers. MFA should be required for all services, particularly webmail, VPNs, and accounts that access critical systems. Organizations should also monitor authentication servers for unauthorized modifications.
5. Audit Accounts and Privileges
Regularly review domain controllers, servers, workstations, and Active Directory for new or unrecognized accounts. Audit user accounts with administrative privileges and enforce the principle of least privilege. Disable unused accounts and ensure account lockout policies are active.
6. Disable Unnecessary Command-Line Access
Privilege escalation and lateral movement often depend on command-line utilities. Disabling or restricting command-line and scripting activities where they are not needed can significantly impede an attacker's ability to escalate privileges and move laterally.
Incident Response Recommendations
If a compromise is detected before encryption occurs, organizations should:
- Immediately isolate compromised hosts by quarantining or taking them offline
- Preserve encrypted files, file timestamps, ransom notes, and system logs for forensic analysis
- Initiate threat hunting to scope the intrusion and identify all compromised devices and accounts
- Review logs from network appliances to identify anomalous privileged user activity
- Report the compromise to the FBI and other appropriate agencies
- Use CISA's Eviction Strategies Tool (Playbook-NG and COUN7ER) to assemble a systematic eviction plan
If encryption has already occurred, organizations should follow the Ransomware and Data Extortion Response Checklist in CISA's joint #StopRansomware Guide, available at StopRansomware.gov.
The Broader Ransomware Landscape in 2026
Gunra is not operating in isolation. The ransomware landscape in 2026 has seen a notable spike in attacks, with multiple active RaaS platforms competing for affiliates and victims. Recent reports indicate that ransomware gangs are increasingly targeting mid-level IT managers rather than executives, recognizing that these individuals often have direct access to critical systems and may be more susceptible to social engineering. Local governments across multiple US states have simultaneously dealt with cyberattacks that shut down public services, demonstrating the widespread impact of the current threat wave.
The emergence of AI-driven ransomware attacks has also been documented, with threat actors using large language models to automate portions of the attack chain. While these AI-assisted attacks are still in early stages, they represent a concerning trend toward more automated and scalable ransomware operations.
Conclusion
The Gunra ransomware represents a significant evolution in the ransomware threat landscape. Its roots in the leaked Conti source code, combined with a professionalized RaaS model, sophisticated MFA bypass techniques, and exploitation of known Fortinet vulnerabilities, make it a formidable threat to organizations worldwide. The joint advisory from FBI, CISA, NSA, and international partners underscores the severity of this threat.
However, the identification of a weakness in Gunra's Linux variants demonstrates that defenders are making progress. By prioritizing vulnerability patching, implementing immutable backups, segmenting networks, and maintaining robust incident response capabilities, organizations can significantly reduce their risk of becoming the next Gunra victim. The key is to act before attackers do — because once Gunra gains access to your network, the clock is already ticking.
Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous
Articles published by QUE.COM Intelligence via Yehey.com website.
0 Comments