CTI · reviewed · 2026-08-14

Joint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud Data

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1078 Valid Accounts Stealth
• T1486 Data Encrypted for Impact Impact
• T1490 Inhibit System Recovery Impact
• T1567 Exfiltration Over Web Service Exfiltration

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 45.55.158.47 ipv4 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Gunra Ransomware Encrypted File Extension
id: 91da0e30-4876-4023-bfbc-7905ea124e6f
status: experimental
description: >
    Detects files renamed with the .ENCRT extension by the Gunra ransomware
    family (Windows and Linux variants) documented in the joint
    US-South Korea #StopRansomware advisory (Aug 2026). Gunra encrypts with
    ChaCha20 and RSA-4096 and appends .ENCRT to affected files.
references:
    - https://cyberpress.org/gunra-ransomware-bypasses-vpn-mfa/
    - https://malware.news/t/gunra-ransomware-multithreaded-chacha20-encryption-explained/124675#post_1
author: Tia N. List
date: 2026/08/14
tags:
    - attack.t1486
logsource:
    category: file_event
    product: windows
detection:
    selection_encrt:
        TargetFilename|endswith: '.ENCRT'
    condition: selection_encrt
falsepositives:
    - Files legitimately using a .ENCRT extension outside this campaign (rare); corroborate with encryption activity and ransom demands
level: high
---
title: Gunra Ransomware Pre-Encryption Backup Deletion
id: 3444135b-85ad-4570-8904-cf820aae4f6f
status: experimental
description: >
    Detects destructive backup and volume-shadow operations consistent with
    the Gunra ransomware operation's documented behavior of deleting primary
    data-center and disaster-recovery backups before and after deploying the
    encryptor (joint US-South Korea advisory, Aug 2026), removing recovery
    paths ahead of file encryption.
references:
    - https://cyberpress.org/gunra-cripples-backup-recovery/
    - https://cyberpress.org/gunra-ransomware-bypasses-vpn-mfa/
author: Tia N. List
date: 2026/08/14
tags:
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic_shadow:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'backup'
    condition: 1 of selection_*
falsepositives:
    - Legitimate scheduled backup rotation and shadow-copy cleanup on storage servers
    - Administrators removing stale backups during maintenance windows
level: medium

Splunk SPL raw

# joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet — Splunk SPL variant (derived from joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet.sigma via sigma convert)
# source-sha256: 6ce57a2310e0fb2e1e345aa503a5fc8218ae176e1ceb4b0c0f28eaa7f30371eb v1
TargetFilename="*.ENCRT"

(Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*\\wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*") OR (Image="*\\wbadmin.exe" CommandLine="*delete*" CommandLine="*backup*")

KQL (Sentinel / Defender) raw

# joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet — KQL variant (derived from joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet.sigma via sigma convert)
# source-sha256: 6ce57a2310e0fb2e1e345aa503a5fc8218ae176e1ceb4b0c0f28eaa7f30371eb v1
TargetFilename endswith ".ENCRT"

(Image endswith "\\vssadmin.exe" and (CommandLine contains "delete" and CommandLine contains "shadows")) or (Image endswith "\\wmic.exe" and (CommandLine contains "shadowcopy" and CommandLine contains "delete")) or (Image endswith "\\wbadmin.exe" and (CommandLine contains "delete" and CommandLine contains "backup"))

References

• https://cyberpress.org/gunra-ransomware-bypasses-vpn-mfa/
• https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/
• https://malware.news/t/gunra-ransomware-multithreaded-chacha20-encryption-explained/124675#post_1
• https://cyberscoop.com/us-south-korea-gunra-ransomware-warning/
• https://malware.news/t/cisa-advisory-stopransomware-gunra-ransomware/124662#post_1
• https://gbhackers.com/gunra-ransomware-attack-2/
• https://cyberpress.org/gunra-cripples-backup-recovery/