Analysis Summary

Gunra ransomware has evolved into a sophisticated ransomware-as-a-service (RaaS) operation and is now actively targeting organizations by exploiting vulnerabilities in internet-facing Fortinet VPN and firewall appliances. A joint advisory from the FBI, CISA, DoD Cyber Crime Center, NSA, U.S. Secret Service, and South Korea’s National Police Agency identified CVE-2024-55591 and CVE-2025-24472, authentication-bypass vulnerabilities affecting specific FortiOS and FortiProxy versions, as key initial-access vectors. Gunra first appeared in April 2025 as a double-extortion ransomware strain reportedly derived from leaked Conti source code, but by early 2026 it had developed into a RaaS model offering affiliates a management panel, configurable ransomware builders, and cross-platform encryptors. The group has also operated under the Golden Community alias and recruited penetration testers and ethical hackers as initial-access brokers.

After gaining access, Gunra affiliates employ multiple techniques to bypass MFA, steal credentials, and establish persistent access. In one observed incident, attackers compromised an SSL-VPN administrator account using default credentials and exploited the absence of account lockout controls, then modified authentication files on a corporate VDI portal so that a Gunra-controlled one-time-password value would always be accepted, effectively defeating MFA. Attackers subsequently use tools from the Impacket framework, including psexec.py, smbclient.py, and secretsdump.py, to move laterally through SMB, extract credentials from domain controllers, and conduct pass-the-hash and pass-the-ticket attacks. Gunra operators have also intercepted VPN traffic to steal session cookies for legitimate-session hijacking and, in one case, obtained a symmetric encryption key from an access-control server to decrypt large quantities of stored enterprise passwords.

Gunra follows a double-extortion strategy, stealing sensitive information before encrypting victim systems. Its operators have used a custom main.exe utility to collect files from Microsoft OneDrive and SharePoint, while tools such as 7-Zip, RClone, and FileZilla facilitate data collection, compression, and transfer. Stolen archives have reportedly reached tens of terabytes and have been uploaded to the Mega file-sharing service. After exfiltration, the ransomware encrypts files using ChaCha20 and RSA-4096 through a multi-threaded architecture, appending the .ENCRT extension and creating an R3ADM3.txt ransom note in affected directories. Victims are directed to a Tor-based negotiation portal or qTox for communication and are generally given five to seven days before the attackers threaten to publish or sell the stolen information through their dedicated leak site.

The advisory highlights significant risks for organizations in healthcare, financial services, critical manufacturing, transportation, and government and recommends prioritizing the patching of all internet-facing VPN, firewall, and RDP infrastructure, particularly systems affected by the identified Fortinet vulnerabilities. Organizations should maintain offline and immutable backups, keep backups in segmented locations, implement strong network segmentation to restrict lateral movement, and eliminate default credentials while enforcing account lockout and secure authentication controls. Security teams should specifically audit VPN and VDI authentication files and configurations for unauthorized modifications, monitor for suspicious SMB and credential-dumping activity, detect tools associated with Gunra operations, and investigate unusual OneDrive, SharePoint, Mega, or large-volume archive transfers. Finally, defenders should continuously monitor the IP addresses, domains, file hashes, and other indicators of compromise (IOCs) published in the CISA advisory to identify potential Gunra activity before attackers can complete data theft and encryption.

Impact

• Sensitive Information Theft
• Security Bypass
• File Encryption
• Gain Access

Indicators of Compromise

CVE

• CVE-2024-55591
• CVE-2025-24472

Domain News

IP

• 23.239.119.2
• 23.239.119.3
• 23.239.119.4
• 123.244.187.144
• 182.204.39.118

MD5

• 7dd26568049fac1b87f676ecfaac9ba0

SHA-256

• a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9

SHA1

• bb79502d301ba77745b7dbc5df4269fc7b074cda

Remediation

• Patch Fortinet VPN/Firewall appliances immediately, especially systems affected by CVE-2024-55591 and CVE-2025-24472.
• Remove or disable default credentials and enforce strong, unique administrator passwords.
• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Audit VPN and VDI authentication configurations/files for unauthorized modifications that could bypass MFA.
• Enforce MFA with phishing-resistant methods where possible and monitor for MFA bypass attempts.
• Implement account lockout and rate-limiting controls on VPN, VDI, and administrative accounts.
• Restrict internet exposure of VPN, RDP, firewall management interfaces, and other remote-access services.
• Segment critical systems and networks to limit lateral movement following an initial compromise.
• Monitor for Impacket tools and credential-dumping activity, including psexec.py, smbclient.py, and secretsdump.py.
• Detect suspicious pass-the-hash and pass-the-ticket activity and unusual authentication behavior.
• Monitor VPN traffic for session-cookie theft, session hijacking, and abnormal administrator sessions.
• Protect and regularly rotate encryption keys, service credentials, and privileged account credentials.
• Monitor OneDrive and SharePoint for unusual bulk file access or data-exfiltration activity.
• Investigate large outbound transfers and unexpected use of Mega, RClone, FileZilla, and 7-Zip.
• Maintain offline, immutable, and regularly tested backups in segmented locations to prevent ransomware encryption.