Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks
CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.
CISA, the FBI, and South Korean agencies warned of Gunra ransomware attacks targeting healthcare, financial services, government, and professional services worldwide. The Conti-derived operation exploits internet-facing Fortinet FortiOS and FortiProxy flaws CVE-2024-55591 and CVE-2025-24472 for initial access, then deploys double extortion with Salsa20/ChaCha20 encryption and publishes non-payers on a leak site within five to seven days. Ransomware.Live lists 51 victims since April 2025, mostly in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group uses Impacket tools for SMB lateral movement and NTDS credential dumping, tampers with VDI authentication to accept a designated OTP value to bypass MFA, and launched a RaaS affiliate program in January 2026 under the new alias Golden Community.
- Initial access via Fortinet FortiOS/FortiProxy CVE-2024-55591 and CVE-2025-24472, plus phishing.
- Impacket psexec.py and secretsdump.py used for SMB lateral movement and NTDS credential dumping.
- Tampered VDI authentication portal files to accept a Gunra-designated OTP, bypassing MFA; steals session cookies for hijacking.
- Data exfiltrated via OneDrive, SharePoint, and MEGA; encrypts databases and NAS devices.
- Conti-derived RaaS launched January 2026; recruits pentesters as initial access brokers under Golden Community alias.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1021.002 SMB/Windows Admin SharesT1003.003 NTDST1486 Data Encrypted for ImpactT1567.002 Exfiltration to Cloud Storage
- Vendors
- Fortinet
- Products
- FortiOSFortiProxy
- Malware
- Gunra
- Organizations
- CISAFBIRansomware.LiveKNPA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-55591 | Unauthenticated Super-Admin Bypass in Fortinet FortiOS and FortiProxy | 9.8 | 94% | KEVRansomware | KEV |
| CVE-2025-24472 | Authentication Bypass in Fortinet FortiOS and FortiProxy Grants Super-Admin Access | 8.1 | 7% | KEVRansomware | KEV |
From the original article
5 min read at thehackernews.com
Cybersecurity and intelligence agencies from South Korea and the U. S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.