CRITICAL: Gunra Ransomware Exploits Fortinet FortiOS Auth Bypass Flaws

If you needed proof that ransomware crews are lazy in the most profitable way possible, the joint advisory that CISA, the FBI, and South Korea's National Police Agency published this week is it. Gunra, a double extortion outfit that has been quietly stacking victims since April 2025, is not burning zero-days to get into networks. It is walking through Fortinet authentication bypass flaws that were patched in January 2025 and added to the Known Exploited Vulnerabilities catalog before most organizations had finished their New Year's resolutions.

The advisory, tracked as AA26-222A, lands as Gunra crosses fifty-one publicly listed victims spanning healthcare and public health, financial services, government facilities, manufacturing, transport, utilities, education, retail, and professional and nonprofit services. That is a wide net for a group that most defenders outside the incident response world could not name a week ago. Chris Butera, CISA's acting executive assistant director, framed it plainly when he said Gunra "is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations." Plain is right. There is nothing exotic here, and that is precisely the problem.

The Way In

The headline vulnerability is CVE-2024-55591, an authentication bypass in Fortinet FortiOS and FortiProxy that carries a CVSS score of 9.8. It is a CWE-288 issue, authentication bypass using an alternate path or channel, and it lets a remote unauthenticated attacker reach super-admin privileges through crafted requests to the Node.js websocket module. No credentials, no user interaction, no clever social engineering. Affected builds are FortiOS 7.0.0 through 7.0.16 along with FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. CISA gave federal agencies a remediation deadline of January 21, 2025 for this one, which tells you how long the industry has had to deal with it.

Gunra pairs that with CVE-2025-24472, a related bypass in the same families rated 8.1. This one is fussier. It requires the Security Fabric to be enabled and the attacker to already know the serial numbers of the upstream and downstream devices, at which point crafted CSF proxy requests hand over super-admin on the downstream appliance. It reached the KEV catalog on March 18, 2025. The advisory also flags exploitation of CVE-2024-5559 in Schneider Electric PowerLogic P5 relays, a cryptographic weakness rated 6.8 that allows a specially crafted reset token entered at the front panel to reboot the device or grant full control. That last one demands physical access, which narrows it considerably, but its presence in a ransomware advisory should make anyone running protection relays on a flat network sit up.

Vulnerabilities are only part of the story. Korean investigators reported that Gunra also leaned on default SSL-VPN credentials that nobody ever rotated, and on straightforward phishing. Once the group had a foothold on an SSL-VPN appliance, it intercepted traffic passing through to harvest credentials and session cookies. When your VPN concentrator is the thing collecting the passwords, every downstream control you built on top of those passwords is already compromised.

The Detail That Should Worry You

Buried in the advisory is the single most instructive piece of tradecraft in the whole campaign. Rather than fight multifactor authentication, Gunra operators modified the authentication processing files on a corporate VDI authentication portal server so that a specific one-time password value chosen by the attackers would always authenticate successfully. They did not phish an OTP. They did not swap a SIM. They rewrote the referee.

That is a persistent, silent MFA bypass that survives password resets, survives token reissuance, and produces authentication logs that look entirely legitimate. Unless you are running file integrity monitoring against the authentication components on that portal, there is no obvious signal. This is why CISA's mitigation list specifically calls out file integrity monitoring rather than leaving it as generic hygiene advice. It is also a useful reminder that MFA is a control implemented in software, and software on a compromised host does whatever the person holding the host wants it to do.

What Happens After The Foothold

From there the playbook is depressingly familiar and extremely effective. Gunra moves laterally with Impacket, specifically psexec.py and smbclient.py over SMB, then runs secretsdump.py against domain controllers to pull password hashes out of the NTDS database. Persistence comes from OpenSSH binaries pushed down from attacker-controlled infrastructure, and in at least one case from abusing a Hiware system access control server over SSH.

The operators keep unsociable hours by design, concentrating activity between roughly 10 p.m. and 6 a.m. when the SOC is thin and change windows are quiet. They delete system and network access logs and clear command history behind them. Reconnaissance inside VDI environments deliberately targets documents belonging to IT personnel, because network diagrams and credential spreadsheets written by administrators are the fastest route to everything else.

Exfiltration runs through channels that look like normal business traffic. The group uses an executable named main.exe to reach Microsoft OneDrive and SharePoint, and pushes terabyte-scale compressed archives out to the MEGA file sharing service. CISA's detection guidance leans hard on this stage, recommending alerts on abnormal archive creation and on suspicious administrative use of 7-Zip, Rclone, and FileZilla alongside the Impacket tooling. If you can only instrument one phase of this attack chain, instrument the archiving. It sits between the quiet part and the loud part, and it is the last moment where intervention still saves your data.

The loud part uses ChaCha20 for bulk encryption with RSA-4096 protecting the keys, appending the .ENCRT extension and dropping ransom notes named R3ADM3.txt. The stream cipher choice traces back to Gunra's lineage, since the codebase derives from the leaked Conti source. Encryption is multi-threaded and targets business data first. Before the payload fires, shadow copies go away via WMI, and the group makes a point of destroying backup infrastructure at both the primary site and the disaster recovery site. Anyone whose DR strategy amounts to replicating the production environment to a second data center on the same domain should read that sentence twice.

Economics And One Piece Of Good News

Gunra formalized a ransomware-as-a-service affiliate program in January 2026, complete with a management panel, a configurable builder, cross-platform Windows and Linux lockers, and structured affiliate documentation. Negotiations happen through a chat panel styled to look like WhatsApp, which is a small touch of consumer-grade user experience applied to extortion. Victims typically get five to seven days before their data appears on the leak site, and reported demands have exceeded ten million dollars.

Geographically the group has concentrated on South Korea, Brazil, Spain, Thailand, Hong Kong, Australia, and parts of Europe, with only three reported victims across the United States and Canada. That is not a reason to relax. A RaaS program with an open affiliate model exports targeting decisions to whoever signs up, and affiliate geography changes far faster than tooling does.

The one genuinely encouraging item is that Breakglass Intelligence published analysis in March 2026 identifying a serious cryptographic weakness in Gunra's Linux builds that permits key recovery without paying. If you get hit on Linux, engage responders before you engage the negotiation panel.

What To Actually Do

Patch the Fortinet appliances, and do it with an inventory rather than a memory. FortiOS 7.0.x through 7.0.16 and FortiProxy 7.0.x and 7.2.x in the ranges above need to move to fixed builds now, and if the Security Fabric is enabled anywhere, treat CVE-2025-24472 as equally urgent. Any appliance that was exposed and unpatched at any point during the last year should be treated as potentially compromised rather than merely vulnerable, which means revoking credentials that touched it, rotating the local admin accounts, and reviewing configuration for accounts and automation you do not recognize.

Beyond patching, CISA's guidance is worth following literally. Eliminate default and dormant administrative accounts. Enforce MFA backed by privileged account separation so that a compromised standard identity cannot pivot into administration. Restrict SMB and RDP between network segments rather than treating segmentation as a compliance checkbox. Deploy file integrity monitoring, particularly on authentication portals, given what this group does to them. Keep offline, immutable backups on infrastructure that is physically and administratively separate from production, because Gunra actively hunts the backups it can reach. Pull the STIX indicators from the advisory into your detection platform and map the ATT&CK techniques against what your tooling actually covers today.

For MSPs, this advisory is a ready-made conversation with every client running an aging Fortinet edge, and an external attack surface assessment plus a credential rotation engagement is an easy scoped project to sell off the back of a federal warning with a client's own gear named in it. The stronger recurring play is immutable backup with proven isolation from the production domain, because the backup destruction detail in AA26-222A turns an abstract upsell into a concrete story about why the second data center on the same Active Directory is not a recovery plan.