CISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra Ransomware

Gunra ransomware affiliates exploit CVE-2024-55591 and CVE-2025-24472, authentication-bypass flaws in FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, to gain super-admin privileges on exposed VPN gateways and firewall appliances. Once inside, actors create persistent malicious accounts with random usernames and super-admin profiles, establish SSL-VPN tunnels, and move laterally using Impacket libraries such as psexec.py and secretsdump.py to reach domain controllers, VDI authentication servers, and IT staff virtual desktops. The Windows encryptor uses a multi-threaded architecture that enumerates drive letters A through Z via FindFirstFileW and FindNextFileW, applies ChaCha20 plus RSA-4096 encryption, renames files with the .ENCRT extension, writes a static ransom note named R3ADM3.txt, and deletes volume shadow copies through WMI commands before completing encryption.

A successful breach means full double-extortion: affiliates exfiltrate business-critical documents, databases, PII, and internal email communications before encryption, then threaten publication through a Tor-hosted data-leak site and demand negotiation via qTox with initial demands typically exceeding tens of millions of dollars. The group spans healthcare, finance, manufacturing, transport, government, utilities, education, retail, and professional services across the Americas, Europe, the Middle East, Africa, and Asia-Pacific, and has moved from a single April 2025 ransomware strain to a structured RaaS with a formal affiliate program, cross-platform Windows and Linux payloads, and 14 claimed victims. The Linux variant introduces a recoverable weakness: its encryption keys rely on a predictable srand(time(NULL)) seed, allowing defenders to reconstruct keys from file timestamps and recover .GNRA files without payment, a path that does not exist for Windows targets encrypted with the same ChaCha20 and RSA-4096 scheme.

Patch FortiOS to 7.0.17 or above, FortiProxy to 7.2.13 or above (or 7.0.20 or above for FortiProxy 7.0.x), and eliminate default or dormant administrative accounts immediately; restrict firewall administrative interfaces with local-in policies that allow only predefined management IP groups. Hunt for malicious accounts named forticloud-sync or randomly generated super-admin usernames, audit SSL-VPN user groups for unauthorized members, and review system logs for admin login events with arbitrary srcip and dstip values paired with jsconsole methods. Inspect endpoints for .ENCRT encrypted files, R3ADM3.txt notes, and WMI shadowcopy deletion commands matching the exact cmd.exe /c wbem\WMIC.exe shadowcopy delete syntax. Segment networks between internet-facing VPN gateways, internal VDI environments, and domain controllers to block the observed lateral path from initial access through SMB to Active Directory, because the advisory confirms actors have already bypassed enterprise MFA by rewriting authentication portal files and deploying backdoor OTP values.

Watch whether the Linux variant's weak PRNG is patched by affiliates; if srand is replaced with a cryptographically secure source, the timestamp-based key reconstruction method disappears and Linux victims lose the free-recovery option described in the March 2026 Breakglass Intelligence research. Also watch for new clearnet mirrors or Tor DLS relocations; Gunra moved its original .onion address by March 2026 and previously operated a clearnet mirror at datapub.news between June and July 2025, so any fresh domain or infrastructure rotation signals expanded affiliate recruitment and likely acceleration in victim postings beyond the current 14 claims.