Ransomware operators behind the Gunra group are leveraging two Fortinet security flaws to breach government agencies and critical infrastructure, according to a joint advisory released August 10 by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Republic of Korea's National Police Agency. The gang operates a ransomware-as-a-service model that focuses on exploiting known weaknesses in internet-facing equipment such as firewalls and VPN devices to establish initial entry. After gaining access, affiliates deploy sophisticated methods to maintain persistence and move laterally through networks, enabling them to quietly extract massive volumes of information from Microsoft 365 platforms.
The two vulnerabilities Gunra actors are targeting both allow authentication bypass on specific FortiOS and FortiProxy versions. CVE-2024-55591 is classified as critical and permits a remote attacker to obtain super-admin rights through specially crafted requests sent to the Node.js websocket module. CVE-2025-24472 carries a high severity rating and enables a remote unauthenticated attacker who possesses advance knowledge of both upstream and downstream device serial numbers to acquire super-admin privileges on the downstream device when Security Fabric is turned on, accomplished via manipulated CSF proxy requests. Patches exist for both flaws. The group emerged in April 2025 using leaked Conti ransomware source code from 2022, then launched a structured affiliate program advertised on dark web forums in early 2026 while adopting alternative branding such as "Golden Community." Gunra actors have successfully extracted up to tens of terabytes of information in at least one incident by creating compressed archives filled with sensitive material and transferring them to the file-sharing platform Mega. The gang's ransom demands typically open negotiations at tens of millions of dollars, with victims given five to seven days to respond through a Tor-based portal.
The advisory describes several specific attack methods observed by investigators. In one case, Gunra actors accessed an administrator account for an SSL-VPN appliance by taking advantage of default credentials when account lockout protections weren't enabled, then set up connections between compromised systems and an external attacker-controlled server using the SSH tunneling tool OpenSSH. In another example, the attackers achieved continuous multi-factor authentication bypass by altering authentication processing files on the corporate VDI authentication portal server. Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, noted that "patching fixes the entry point" but "does nothing about an authentication backdoor already embedded in the MFA flow." The ransomware binary includes extensive filtering rules designed to focus encryption only on files consistent with user data, avoiding non-critical files to streamline collection of user-specific information.
The report emphasizes that Gunra operators display particular skill in evading detection through tactical timing and log manipulation. The group primarily carries out malicious activities and internal infrastructure reconnaissance between 10:00pm and 6:00am in the victim's time zone, when administrators are typically offline. They employ multiple stealth and defense impairment techniques including deleting system and network access logs and clearing command history. The advisory recommends organizations prioritize three defensive measures: patching known exploited vulnerabilities in internet-facing systems including VPN gateways and RDP-exposed infrastructure, implementing and testing offline immutable backups stored in a physically separate segmented location to ensure recovery without paying ransom, and segmenting networks to restrict lateral movement from an initially compromised device to other systems. Victims have been identified across multiple global regions and critical sectors including healthcare, financial services, government organizations, and critical manufacturing. Organizations that apply patches without examining authentication stacks for embedded persistence mechanisms remain vulnerable even after closing the initial entry point. The timing advantage ransomware operators gain by working overnight hours when security teams are off-duty represents a gap that structured groups are specifically engineered to exploit.