Threat Advisory: Gunra Ransomware Group Targeting Vulnerable Fortinet Devices

What UltraViolet Cyber is Doing

• Tracking new CVEs and high impact vulnerabilities, analyzing and deploying public Proof-Of-Concept code against custom built targets.
• Proactively enabling custom detections based on the collected artifacts, tactics, techniques, and procedures identified in this activity.
• Performing hypothesis driven threat hunts based on threat actor behavior and artifacts. UVCyber customers will be informed of the results through secure channels.
• Parsing available victim dump data for any social, financial, business, or technical relations to UVCyber Clients and partner organizations.
• Aggregating threat intelligence from myriad sources and applying the most up-to-date knowledge to proactive threat hunting and response.
  
  
  

ADVERSARY PROFILE

Gunra

Golden Community

Notable TTPs

1. Exploiting known vulnerabilities in internet-facing Fortinet FortiOS and FortiProxy appliances for initial access
2. Hijacking SSL-VPN traffic control functionality to intercept credentials and session cookies
3. Tampering with VDI authentication files to enable a static one-time password and bypass multi-factor authentication
4. Using Impacket tools such as psexec.py, smbclient.py, and secretsdump.py for lateral movement and credential dumping
5. Exploiting default or dormant administrative accounts on SSL-VPN appliances
6. Stealing symmetric encryption keys from access control servers to decrypt stored enterprise credentials
7. Exfiltrating data to Microsoft OneDrive, SharePoint, and the MEGA file-sharing service before encryption
8. Deleting backups at primary and disaster recovery sites before and after deploying ransomware

Gunra represents a maturing ransomware-as-a-service model that lowers the technical bar for affiliates while still achieving sophisticated outcomes against hardened targets. Built on Conti's leaked codebase, the malware supports both Windows and Linux payloads and uses fast stream ciphers capable of encrypting very large datasets quickly. Since formalizing its affiliate program in early 2026, Gunra has provided partners with a management console, a configurable builder, and structured documentation, functionally commoditizing ransomware deployment for less experienced criminals.

Gunra follows a double-extortion model, meaning affiliates both steal a victim's data and encrypt their systems. This gives them two separate points of leverage: victims face operational disruption from encrypted files and the threat of stolen data being published on a leak site if payment isn't made within five to seven days, even if they can restore from backup.

The group's initial access technique relies on patching gaps rather than novel exploitation. CVE-2024-55591 is a critical authentication bypass flaw in FortiOS and FortiProxy that grants attackers super-admin privileges on affected devices, while CVE-2025-24472 is a related high-severity authentication bypass impacting the same products. Both vulnerabilities were disclosed and patched over a year ago, yet Gunra continues to find unpatched, internet-facing instances still exposed.

What distinguishes Gunra operationally is its systematic targeting of identity infrastructure. Affiliates have manipulated SSL-VPN traffic-control features to intercept credentials and session cookies from users authenticating to a corporate VDI portal, then used those stolen sessions to impersonate legitimate users. In at least one case, they altered authentication-processing files so a Gunra-chosen one-time password value would always succeed, neutralizing MFA rather than bypassing it just once.

Additional tradecraft includes exploiting default or dormant administrative accounts, harvesting a symmetric encryption key from an access-control server to decrypt stored enterprise credentials, and using Impacket utilities for SMB-based lateral movement and credential dumping. The group operates mainly overnight, clears logs and command history, exfiltrates data via a custom executable and the MEGA file-sharing service, and deletes backups at both primary and disaster-recovery sites before and after encryption.

This activity matters because it shows patch debt on perimeter devices, not novel exploits, is driving major ransomware losses against critical infrastructure. Both Fortinet vulnerabilities were disclosed and patched over a year ago, yet they are still yielding successful intrusions today. This gap underscores that vulnerability management and asset visibility, especially for internet-facing appliances like VPNs and firewalls, remain a primary enabler for well-resourced RaaS operations. It also signals that attackers don't need zero-days to succeed; they simply need organizations to be slow to patch. For stakeholders, this reframes "known" vulnerabilities as an ongoing operational risk rather than a solved problem once a patch exists.

The MFA-bypass technique is especially significant because it undermines a control many organizations treat as a definitive safeguard. If authentication files on VDI or SSL-VPN portals can be silently modified so that attacker-chosen credentials are always accepted, MFA alone cannot be assumed to stop account takeover. This matters to stakeholders because breach notification obligations, cyber insurance terms, and customer assurances often lean heavily on the presence of MFA as evidence of due diligence. Gunra's approach shows that the mere existence of MFA doesn't guarantee its integrity, which has implications for how confidently organizations and their boards can rely on that control during risk assessments or after an incident.

The systematic deletion of backups before and after encryption also raises the stakes for business continuity and disaster recovery planning. By deliberately targeting both primary and disaster-recovery backup locations, Gunra affiliates aim to remove the safety net organizations rely on to avoid paying ransoms or enduring prolonged outages. This directly affects recovery time objectives, insurance claims, and the overall calculus victims face when deciding whether to negotiate. Stakeholders responsible for continuity planning should recognize that backup availability can no longer be assumed once an intrusion has occurred undetected for any length of time.

Finally, while Gunra's victim base has skewed heavily toward Asia-Pacific, South America, and Europe so far, with only a small number of confirmed North American victims, the sector spread, healthcare, financial services, government, and manufacturing, shows a targeting model that is opportunistic rather than tied to any single region. Combined with a growing affiliate program actively recruiting new operators, this suggests North American organizations should not read the current victim geography as a reason for complacency. This carries direct implications for operational continuity, regulatory reporting obligations, and public safety, particularly for healthcare and government entities where service disruption can affect the public directly rather than just the organization's bottom line.

• Tracking new CVEs and high impact vulnerabilities, analyzing and deploying public Proof-Of-Concept code against custom built targets.
• Proactively enabling custom detections based on the collected artifacts, tactics, techniques, and procedures identified in this activity.
• Performing hypothesis driven threat hunts based on threat actor behavior and artifacts. UVCyber customers will be informed of the results through secure channels.
• Parsing available victim dump data for any social, financial, business, or technical relations to UVCyber Clients and partner organizations.
• Aggregating threat intelligence from myriad sources and applying the most up-to-date knowledge to proactive threat hunting and response.