A coalition of cybersecurity agencies, including the FBI, CISA, the Department of Defense Cyber Crime Center, the NSA, the U.S. Secret Service, and South Korea’s National Police Agency, has issued a joint advisory highlighting a series of attacks by the Gunra ransomware group. This group is actively exploiting known vulnerabilities in Fortinet VPNs to circumvent multi-factor authentication (MFA) and exfiltrate sensitive enterprise data before encrypting victim networks.
Gunra emerged in April 2025 as a double-extortion ransomware variant, reportedly built upon leaked Conti source code. By early 2026, the group had evolved into a ransomware-as-a-service operation, providing affiliates with a management panel, customizable ransomware builders, and cross-platform locker payloads via dark web forums. The FBI has also observed the group rebranding as Golden Community, actively recruiting penetration testers and ethical hackers as initial access brokers in exchange for a share of ransom proceeds.
Exploitation of Fortinet VPN Vulnerabilities
Investigations have revealed that Gunra affiliates primarily gain initial access by exploiting known vulnerabilities in internet-facing VPN and firewall appliances, particularly CVE-2024-55591 and CVE-2025-24472. These authentication bypass flaws affect specific versions of FortiOS and FortiProxy.
In one documented incident, attackers compromised an SSL-VPN administrator account that was protected by default credentials without lockout controls. They then modified authentication files on a corporate Virtual Desktop Infrastructure (VDI) portal, allowing a Gunra-designated one-time password to always authenticate successfully, effectively nullifying MFA protections.
Once inside the network, Gunra operators utilize tools from the Impacket suite, such as psexec.py, smbclient.py, and secretsdump.py, to move laterally via SMB and extract credentials from domain controllers. This enables pass-the-hash and pass-the-ticket attacks. The group has also intercepted VPN traffic to steal session cookies, facilitating the hijacking of legitimate user sessions. In at least one case, they obtained a symmetric encryption key from a system access control server to decrypt stored enterprise passwords.
Data Exfiltration and Encryption Tactics
Consistent with their double-extortion strategy, Gunra exfiltrates data before deploying their encryptor. They have used a custom tool named main.exe to extract files from Microsoft OneDrive and SharePoint, transferring compressed archives—sometimes totaling tens of terabytes—to the file-sharing platform Mega. Open-source utilities like 7-Zip, RClone, and FileZilla support this collection and transfer process.
The final payload employs ChaCha20 and RSA-4096 encryption in a multi-threaded architecture, appending the .ENCRT extension to locked files and dropping a ransom note, R3ADM3.txt, in every affected directory. Victims are directed to a Tor-based negotiation portal or the encrypted messaging app qTox, typically given five to seven days before Gunra threatens to leak or sell the stolen data on their dedicated leak site.
The advisory urges organizations, especially those in healthcare, financial services, critical manufacturing, transportation, and government sectors, to prioritize patching internet-facing VPN and Remote Desktop Protocol (RDP) infrastructure. It also recommends maintaining offline and immutable backups in segmented locations and enforcing network segmentation to contain lateral movement.
Given Gunra’s demonstrated ability to bypass MFA through authentication file tampering, security teams should audit VPN and VDI authentication logic for unauthorized modifications and monitor for known Gunra-linked IP addresses, domains, and file hashes published in the CISA advisory’s indicators of compromise.
This development underscores the critical importance of timely patch management and robust authentication mechanisms. Organizations must remain vigilant against evolving ransomware tactics that exploit known vulnerabilities to bypass security controls and compromise sensitive data.
