Search: “Gunra”

Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks

CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.

CISA, the FBI, and South Korean agencies warned of Gunra ransomware attacks targeting healthcare, financial services, government, and professional services worldwide. The Conti-derived operation exploits internet-facing Fortinet FortiOS and FortiProxy flaws CVE-2024-55591 and CVE-2025-24472 for initial access, then deploys double extortion with Salsa20/ChaCha20 encryption and publishes non-payers on a leak site within five to seven days. Ransomware.Live lists 51 victims since April 2025, mostly in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group uses Impacket tools for SMB lateral movement and NTDS credential dumping, tampers with VDI authentication to accept a designated OTP value to bypass MFA, and launched a RaaS affiliate program in January 2026 under the new alias Golden Community.

The Hacker News·Aug 12, 08:42 UTC · Aug 12, 2026Ransomware in the wildCVE-2024-55591CVE-2025-24472

Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure

US and Korean agencies warn Gunra ransomware actors exploit Fortinet flaws and stealthily exfiltrate large data volumes, targeting critical infrastructure.

US and Korean authorities warned that Gunra ransomware actors exploit Fortinet vulnerabilities to gain access and use stealthy techniques to exfiltrate vast volumes of data, including from Microsoft services. The group is targeting critical infrastructure organizations. Defenders should prioritize Fortinet patching and watch for large, quiet data egress.

Infosecurity Magazine·Aug 12, 13:15 UTC · Aug 12, 2026Ransomware in the wild

North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn

The Record·Jul 30, 14:13 UTC · Jul 30, 2026Ransomware

Ransomware gangs go after EMEA healthcare's supply chain

Help Net Security·Jul 24, 00:00 UTC · Jul 24, 2026Ransomware