Gunra Ransomware Exploits Fortinet Auth Bypass Flaws in Global Double Extortion Campaign

Summary

The FBI, CISA, DC3, NSA, USSS, and South Korea's KNPA jointly published advisory AA26-222A on August 10, 2026, detailing the Gunra ransomware operation. Gunra actors gain initial footholds primarily by exploiting two authentication bypass vulnerabilities in Fortinet FortiOS and FortiProxy, then move laterally through victim networks using Impacket tooling, RDP, and stolen VPN session data before deploying a ChaCha20 and RSA-4096 encryptor.

Gunra runs a double extortion model, exfiltrating business documents, databases, and email data before encryption and threatening publication on a Tor-based leak site if victims refuse to pay. The group has evolved from a 2025 Conti-derived variant into a structured ransomware-as-a-service platform, and its affiliates have struck government, healthcare, financial, and critical infrastructure organizations worldwide.

Background

The FBI first observed Gunra ransomware in April 2025. The malware is derived from, or heavily influenced by, the Conti ransomware source code that leaked in 2022, and its operators quickly stood up a dedicated leak site on the Tor network to pressure victims. Early campaigns targeted Windows environments; by mid-2025 the group introduced a Linux-capable encryptor and broadened toward cross-platform targeting.

By January 2026, Gunra had formalized a ransomware-as-a-service affiliate program advertised on dark web forums, offering a management panel, a configurable ransomware builder, cross-platform payloads, and affiliate documentation. The FBI has observed the operation adopting the alias Golden Community as part of this expansion, and Gunra affiliates have actively recruited penetration testers and ethical hackers to act as initial access brokers in exchange for a cut of ransom proceeds. Victims span the Americas, Europe, the Middle East, Africa, and the Asia-Pacific across healthcare, financial services, government, manufacturing, transportation, utilities, academia, media, retail, and nonprofit sectors.

Vulnerability Details

CVE ID	CVSS Score (NVD)	EPSS Score	Affected Products
CVE-2024-55591	9.8 (Critical)	98.26%	FortiOS 7.0.0-7.0.16; FortiProxy 7.0.0-7.0.19 and 7.2.0-7.2.12
CVE-2025-24472	8.1 (High)	3.87%	FortiOS 7.0.0-7.0.16; FortiProxy 7.0.0-7.0.19 and 7.2.0-7.2.12

Attack Methodology

1. 1. Initial access via edge device exploitation. Gunra actors exploit CVE-2024-55591 and CVE-2025-24472 against internet-facing FortiOS and FortiProxy devices; KNPA separately observed credential-exposure and SSH access-control weaknesses used against VPN gateways.
2. 2. File system enumeration. The Windows encryptor calls the native FindFirstFileW and FindNextFileW APIs to enumerate every accessible drive letter from A through Z ahead of encryption.
3. 3. Persistence and privilege escalation. Actors compromise SSL-VPN administrator accounts by abusing default credentials where lockout controls are absent, then modify account configuration to bypass mandatory password-change requirements.
4. 4. Lateral movement and command and control. Impacket's psexec.py and smbclient.py move actors across the network over SMB; stolen VDI session data enables RDP pivoting into authentication servers, the Active Directory server, and IT staff desktops, while a downloaded OpenSSH tunneling tool maintains persistent external connections.
5. 5. Credential access. secretsdump.py dumps NTDS password hashes from domain controllers for pass-the-hash and pass-the-ticket use; actors also sniff SSL-VPN traffic to steal VDI session cookies and tamper with authentication files so a fixed one-time password always validates, bypassing MFA. In one case, a stolen symmetric key from a Hiware access control server let actors decrypt stored enterprise server passwords.
6. 6. Stealth and defense impairment. Gunra actors delete system and network logs, clear command history, and conduct reconnaissance during late-night to early-morning hours. The binary itself checks for IsDebuggerPresent and filters out system directories and executable file types to avoid unnecessary encryption overhead.
7. 7. Collection and exfiltration. Business documents, databases, PII, and internal email are collected; a malicious main.exe pulls data from OneDrive and SharePoint, and archives built with 7-Zip, WinRAR, and RClone are exfiltrated over FileZilla and the file-sharing service Mega, with volumes reaching tens of terabytes in observed cases.
8. 8. Impact. The encryptor applies multi-threaded ChaCha20 plus RSA-4096 encryption, appending the .ENCRT extension, drops a static R3ADM3.txt ransom note per directory, deletes volume shadow copies via WMI, and in one incident deleted backup archives at both the primary and disaster-recovery data centers before demanding payment through a Tor negotiation portal or qTox within five to seven days.

Indicators of Compromise (IOCs)

IP Addresses/Domains:

• ● 23.239.119[.]2
• ● 23.239.119[.]3
• ● 23.239.119[.]4
• ● 23.239.119[.]5
• ● 23.239.119[.]6
• ● 86.54.28[.]216
• ● 103.125.234[.]14
• ● 70.36.99[.]82
• ● 211.21.210[.]181
• ● 123.184.143[.]105
• ● 182.204.21[.]240
• ● 182.204.16[.]112
• ● 123.244.187[.]144
• ● 182.204.39[.]118
• ● 67.43.53[.]10
• ● 123.246.37[.]108
• ● 91.201.66[.]146
• ● datapub[.]news
• ● gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad[.]onion
• ● lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd[.]onion
• ● nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onion

Negotiation email addresses:

• ● a00f105546345756@proton[.]me
• ● 4569f6322bc3b22e9@proton[.]me
• ● ilovemycubscout@gmail[.]com
• ● 6449a3c1e612168526@proton[.]me

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1047	Windows Management Instrumentation	Execution
T1106	Native API	Execution
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Execution
T1098	Account Manipulation	Persistence
T1133	External Remote Services	Persistence
T1078.001	Valid Accounts: Default Accounts	Privilege Escalation
T1078.002	Valid Accounts: Domain Accounts	Privilege Escalation
T1622	Debugger Evasion	Defense Evasion
T1070.003	Indicator Removal: Clear Command History	Defense Evasion
T1678	Delay Execution	Defense Evasion
T1679	Selective Exclusion	Defense Evasion
T1685	Disable or Modify Tools	Defense Evasion
T1003.003	OS Credential Dumping: NTDS	Credential Access
T1040	Network Sniffing	Credential Access
T1539	Steal Web Session Cookie	Credential Access
T1555	Credentials from Password Stores	Credential Access
T1003	OS Credential Dumping	Credential Access
T1556.006	Modify Authentication Process: Multi-Factor Authentication	Credential Access
T1083	File and Directory Discovery	Discovery
T1049	System Network Connections Discovery	Discovery
T1021.001	Remote Services: Remote Desktop Protocol	Lateral Movement
T1021.002	Remote Services: SMB/Windows Admin Shares	Lateral Movement
T1550.002	Use Alternate Authentication Material: Pass the Hash	Lateral Movement
T1550.003	Use Alternate Authentication Material: Pass the Ticket	Lateral Movement
T1560	Archive Collected Data	Collection
T1530	Data from Cloud Storage	Collection
T1005	Data from Local System	Collection
T1114	Email Collection	Collection
T1105	Ingress Tool Transfer	Command and Control
T1572	Protocol Tunneling	Command and Control
T1567	Exfiltration Over Web Service	Exfiltration
T1048	Exfiltration Over Alternative Protocol	Exfiltration
T1486	Data Encrypted for Impact	Impact
T1657	Financial Theft	Impact
T1490	Inhibit System Recovery	Impact

Visual Attack Flow

Mitigation

1. 1. Patch internet-facing Fortinet devices. Prioritize remediation of CVE-2024-55591 and CVE-2025-24472 on FortiOS and FortiProxy, alongside all other internet-facing VPN gateways and RDP-exposed infrastructure.
2. 2. Maintain offline, immutable backups. Retain multiple copies of sensitive data and servers in a physically separate, segmented, and secure location, since Gunra actors have targeted and deleted backup archives at both primary and disaster-recovery sites.
3. 3. Audit for unrecognized accounts. Review domain controllers, servers, workstations, and Active Directory for new or unused accounts, given Gunra's pattern of hijacking dormant accounts and bypassing password-change requirements.
4. 4. Require MFA on all critical services. Apply MFA to webmail, VPNs, and systems accessing critical infrastructure; note that Gunra has demonstrated MFA-bypass capability by tampering with OTP validation logic on compromised authentication portals.
5. 5. Restrict command-line and scripting activity. Disable unnecessary command-line and scripting permissions, since Gunra actors relied on cmd.exe and Impacket scripts for privilege escalation and lateral movement.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.