Reported by 9 outlets
Joint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud Data
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.01 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
A joint #StopRansomware advisory from CISA, the FBI, NSA, the Secret Service, the DoD Cyber Crime Center, and South Korea's National Police Agency on August 10, 2026 describes Gunra, a ransomware-as-a-service operation built on the Conti source code leaked in February 2022, first observed by the FBI in April 2025, and running a formal affiliate program with a builder, management panel, and cross-platform payloads since January 2026. Its primary way in is Fortinet: the group chains the FortiOS and FortiProxy authentication bypasses CVE-2024-55591 and CVE-2025-24472, both CWE-288 and rated CVSS 9.6 in Fortinet's FG-IR-24-535, to mint persistent super-admin accounts and reach SSL VPN access that sidesteps MFA, supplemented by credential exposure, exposed RDP, and weak SSH access control on internet-facing VPN gateways. The payload encrypts Windows and Linux with ChaCha20 and RSA-4096, appends .ENCRT, and the Linux encryptor can run 100 threads at once, compressing the window between hands-on access and full encryption on servers, VMs, and NAS. Exfiltration runs to tens of terabytes, victims get five to seven days to negotiate over Tor and qTox, and the group, also tracked as Golden Community, reportedly recruits ethical hackers and penetration testers and benefits from tooling tied to North Korean government-linked hackers.
The context that makes this advisory more than another ransomware profile is how old the door is. Fortinet published the fix, FortiOS 7.0.17, FortiProxy 7.0.20, and FortiProxy 7.2.13, on January 14, 2025, and confirmed exploitation in the wild that same day; Arctic Wolf had already traced the campaign back to November 16, 2024, and Shadowserver counted nearly 50,000 vulnerable instances within two weeks of the patch. KEV entries carry a known ransomware campaign use flag for both CVEs, dated January 14 and March 18, 2025, meaning ransomware exploitation of these exact bugs was documented before Gunra existed. So the population at risk in August 2026 is not Fortinet customers in general, it is the residue that has sat unpatched and management-exposed for roughly nineteen months, and the FBI's observation that direct ransom emails to victim management got limited success suggests an operation scaling through affiliates on commodity access rather than precision. The headline MFA bypass is also narrower than it sounds: it works by creating local users inside existing SSL VPN groups from a super-admin session, which means every step leaves FortiOS config and event records a defender can audit. And Gunra's documented habit of deleting backups at both the primary and the disaster-recovery site means ordinary backup plans are assumed compromised by design; only immutable or truly out-of-band copies decide the outcome.
Patch to 7.0.17 or later on FortiOS and 7.0.20 or 7.2.13 or later on FortiProxy, or apply FG-IR-24-535's workarounds: disable the HTTP/HTTPS administrative interface, restrict it with local-in policies to a management-only source group, disable Security Fabric with config system csf, set status disable for the CVE-2025-24472 path, and use non-guessable admin usernames as a partial brake. Then hunt what the advisory and its predecessors actually document: event logs with subtype system and ui jsconsole where srcip and dstip are 127.0.0.1, 127.0.0.2, or the 8.8.8.8/8.8.4.4 and 1.1.1.1/2.2.2.2 pairs; local traffic to TCP 8023 and 9980 on loopback; cfgpath system.admin Add events with accprofile super_admin and five or six character random object names like vOcep or Dbr3W; SSL VPN portals on nonstandard ports such as 4433, 59449, and 59450; DCSync activity, including from a workstation named kali; and web management HTTPS sessions over 1 MB lasting over 100 seconds from WAN-sourced VPS addresses. Check the FG-IR-24-535 indicator set, 45.55.158.47, 87.249.138.47, 155.133.4.175, 37.19.196.65, 149.22.94.37, and 158.255.215.126, noting Fortinet's warning that the logged source IPs in exploit traffic are attacker-chosen and useless for blocking. On endpoints, any .ENCRT files or 100-thread ChaCha20 encryptor processes mean the intruder is already past the edge, so treat firewall logs as the source of truth and assume pre-encryption staging included backup and archive deletion at the DR site.
Two things would change this assessment. Confirmed use of the advertised builder and management panel in new campaigns, or a visible climb in leak-site postings since the January 2026 RaaS launch, would mark the scaling phase the FBI expects, and push this from patch-and-hunt to assume-breach triage for every exposed device that skipped 7.0.17. Independent confirmation of the North Korea-linked tooling claim, or attribution of Golden Community, would likewise recast an affiliate quantity problem as a state-adjacent one, with different expectations for targeting and persistence.
Timeline
-
original reporting
Joint US–South Korea Advisory: Gunra Ransomware Exploits Fortinet VPNs to Bypass MFA and Steal Cloud Data
cyberpress.org · 64d ago · August 11th, 2026
CISA and South Korean agencies issued a joint #StopRansomware advisory on the Gunra ransomware-as-a-service operation, which is exploiting vulnerable Fortinet VPN appliances, weak remote-access controls, and exposed RDP infrastructure to enter enterprise networks — chaining FortiOS authentication bypasses CVE-2024-55591 and CVE-2025-24472 to create persistent superuser accounts and bypass MFA. Built on leaked Conti source code and first seen in April 2025, Gunra has hit government, healthcare, finance, manufacturing, transportation, utilities, education, media, and retail across Africa, the Americas, Asia-Pacific, Europe, and the Middle East. The group recruits ethical hackers and penetration testers and reportedly benefits from tools tied to North Korean government-linked hackers; affiliates exfiltrate documents and data before encryption, then threaten publication on a Tor-hosted leak site. Windows and Linux variants encrypt files with ChaCha20 and RSA-4096, appending the .ENCRT extension. Patch exposed VPNs immediately, enforce phishing-resistant MFA, and segment edge infrastructure.
-
update from arcticwolf.com
Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls
arcticwolf.com · 642d ago · January 10th, 2025
Arctic Wolf Labs documented a campaign against FortiGate firewalls with exposed management interfaces, with anomalous jsconsole activity observed as early as November 16, 2024 on firmware 7.0.14 through 7.0.16. Attackers created random-named super_admin accounts, added local users to SSL VPN groups, and reached DCSync lateral movement; loopback traffic hit TCP ports 8023 and 9980, and jsconsole logins used spoofed source and destination IPs such as 127.0.0.1 and the 8.8.8.8/8.8.4.4 and 1.1.1.1/2.2.2.2 pairs. Arctic Wolf assessed mass exploitation of a zero-day as highly likely, four days before Fortinet published its advisory.
-
update from fortiguard.com
FG-IR-24-535: Authentication bypass in Node.js websocket module and CSF requests
fortiguard.com · 638d ago · January 14th, 2025
Fortinet's PSIRT advisory for CVE-2024-55591 (CVE-2025-24472 added in the February 11, 2025 update) describes a CWE-288 authentication bypass in FortiOS and FortiProxy allowing super-admin privileges via crafted requests to the Node.js websocket module or CSF proxy requests, rated CVSSv3 9.6 and marked exploited in the wild. Fixed releases are FortiOS 7.0.17, FortiProxy 7.0.20, and FortiProxy 7.2.13; workarounds are disabling the HTTP/HTTPS administrative interface, local-in policies restricting management access, or disabling Security Fabric. IoCs include jsconsole admin logins and object additions from arbitrarily generated source IPs (1.1.1.1, 8.8.8.8, 127.0.0.1 among others), randomly named admin accounts such as vOcep, and attacker infrastructure led by 45.55.158.47.
-
update from cisa.gov
CISA KEV catalog addition: CVE-2024-55591
cisa.gov · 638d ago · January 14th, 2025
CISA added CVE-2024-55591 to the Known Exploited Vulnerabilities catalog on January 14, 2025, the same day Fortinet published FG-IR-24-535, with a federal remediation due date of January 21, 2025. The entry is flagged with known ransomware campaign use, establishing ransomware exploitation of this Fortinet authentication bypass more than a year before Gunra's advisory.
-
update from labs.watchtowr.com
Get FortiRekt, I Am The Super_Admin Now - Fortinet FortiOS Authentication Bypass CVE-2024-55591
labs.watchtowr.com · 625d ago · January 27th, 2025
watchTowr Labs researchers Sonny and Aliz Hammond published root-cause analysis and a proof of concept for CVE-2024-55591: a pre-authentication WebSocket to /ws/cli/ passes the local_access_token check, then races the Telnet CLI handshake on localhost port 8023 to inject a login context with an attacker-chosen super_admin profile before the server sends its Connected greeting, demonstrated against FortiGate-VM64-AWS v7.0.16. The post cites Shadowserver counts of nearly 50,000 vulnerable instances and releases a detection script and PoC. It also notes Arctic Wolf's campaign reporting emerged before Fortinet's advisory.
-
update from cisa.gov
CISA KEV catalog addition: CVE-2025-24472
cisa.gov · 575d ago · March 18th, 2025
This confirmed exploitation of the second flaw now chained by Gunra roughly two months after the initial advisory.
-
update from malware.news
CISA Advisory: #StopRansomware: Gunra Ransomware
malware.news · 64d ago · August 10th, 2026
Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom… Source Article Link: https://databreaches.net/2026/08/10/cisa-advisory-stopransomware-gunra-ransomware/
-
update from cyberscoop.com
U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang
cyberscoop.com · 64d ago · August 10th, 2026
Gunra has gone after sectors such as academia, financial services and insurance, government services and facilities, healthcare, manufacturing and construction, media, retail, transportation and utilities. Its global scope is far-ranging, according to Monday’s alert : Africa, the Americas, the Asia-Pacific, Europe and the Middle East. “Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations,” said Chris Butera, acting assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency, which produced the advisory with the Department of Defense’s Cyber Crime Center, FBI, National Security Agency, Secret Service and Republic of Korea’s National Police Agency. The alert is part of the #StopRansomware series, a joint FBI-CISA project aimed at network defenders. The FBI first took notice of Gunra in April of last year. By January of this year, Gunra had launched a formal ransomware-as-a-service affiliate and was growing in its ambition, Monday’s alert states.
-
update from cyberpress.org
Gunra Ransomware Exploits Fortinet VPN Flaws to Bypass MFA, Steal Cloud Data and Encrypt Networks
cyberpress.org · 63d ago · August 11th, 2026
By early 2026, the operators had expanded into a structured affiliate program, advertising a ransomware builder, management panel, cross-platform payloads, and documentation on dark web forums. Its affiliates steal sensitive information before encrypting files, then threaten to publish or sell the data through a dedicated leak site if the victim refuses to pay. Negotiations are conducted through a Tor-based portal and the qTox encrypted messaging application, often with victims given five to seven days to respond. Gunra Ransomware Bypasses VPN MFA According to the advisory, Gunra affiliates primarily gain initial access by exploiting known vulnerabilities in internet-facing devices, particularly firewalls and VPN gateways. The threat actors have also exploited credential exposure and
-
update from malware.news
Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained
malware.news · 63d ago · August 11th, 2026
Affiliates exfiltrate documents, databases, and internal email to cloud services, with volumes reaching tens of terabytes. The Picus Platform simulates Gunra attacks and validates prevention signatures across existing preventive security controls.
-
update from bleepingcomputer.com
US and South Korea warn of Gunra ransomware targeting govt agencies
bleepingcomputer.com · 63d ago · August 11th, 2026
In a Monday joint advisory , they said the ransomware group uses a malware variant based on the Conti ransomware source code leaked in February 2022, in attacks targeting a wide range of industry sectors, from healthcare and public health to financial and government services. "The FBI observed Gunra actors attempting to communicate directly with management staff at victim companies via email to solicit ransom payments with limited success." The ransomware gang has been observed attacking Fortinet firewalls to gain a foothold on their targets' networks using exploits targeting two critical authentication vulnerabilities (CVE-2024-55591 and CVE-2025-24472) in FortiOS and FortiProxy software. Additionally, while their attacks first focused on Windows environments, the ransomware actors moved to cross-platform campaigns after introducing a Linux variant in mid-2025.
-
update from cyberpress.org
Gunra Targets Primary and Disaster-Recovery Backups Before File Encryption
cyberpress.org · 61d ago · August 13th, 2026
Gunra ransomware operators are taking a destructive approach designed to remove every easy recovery path before locking victim files. In a documented incident, the group deleted backup and archived data stored at both the primary data center and the disaster-recovery site before and after deploying ransomware. The tactic greatly increases pressure on victims because even organizations with standard backup plans may find their recovery infrastructure unavailable.
-
update from gbhackers.com
Gunra Ransomware Uses Up to 100 ChaCha20 Threads to Rapidly Encrypt Linux Systems
gbhackers.com · 61d ago · August 13th, 2026
Gunra ransomware has added a Linux encryptor to its arsenal, giving affiliates control over how they lock enterprise data. The command-line payload can launch up to 100 encryption threads, a design that compresses the time defenders have to detect and interrupt an attack on Linux servers, virtual machines, NAS appliances, and storage.