Gunra ransomware has rapidly evolved from a new entrant to a significant threat targeting enterprise environments. The group employs sophisticated tactics to breach exposed edge devices, exfiltrate sensitive data, and encrypt systems across both Windows and Linux networks, causing widespread disruption.
Initially detected in Windows systems in April 2025, Gunra expanded its operations by introducing a Linux variant and launching a ransomware-as-a-service program in January 2026. The operation leverages leaked Conti source code and employs a double extortion strategy: encrypting victims’ files while threatening to publish or sell the stolen data.
Analysts have observed that Gunra affiliates exploit vulnerabilities in FortiOS and FortiProxy authentication mechanisms, such as CVE-2024-55591 and CVE-2025-24472, to gain administrative access. This campaign has targeted sectors including government, critical infrastructure, healthcare, finance, and nonprofit organizations globally. Attackers exfiltrate vast amounts of data—sometimes tens of terabytes—before deploying the ransomware, underscoring the importance of early detection, robust identity security, and well-tested recovery plans.
Exploitation of Stolen Sessions and RDP
Gunra operators prefer using legitimate remote management tools and existing accounts over deploying custom malware, which can be more easily detected. After compromising an administrator’s workstation, they access the SSL-VPN administration console and modify an unused account to bypass mandatory password changes. This subtle configuration change provides a persistent bridge between external and internal networks.
Utilizing stolen session data, attackers infiltrate internal virtual desktop infrastructure (VDI) environments. They employ Remote Desktop Protocol (RDP) to access VDI authentication web servers, Active Directory servers, and IT staff’s virtual desktops. This approach is particularly concerning, as Active Directory serves as the central repository for user credentials and permissions in many Windows networks. Gaining access allows attackers to map the network and escalate their privileges.
In addition, Gunra utilizes tools like Impacket over SMB and OpenSSH tunnels to move laterally within the network. On compromised domain controllers, they execute password-hash dumping tools to facilitate pass-the-hash and pass-the-ticket attacks. They also manipulate VDI portal authentication files to maintain access, effectively undermining multi-factor authentication mechanisms.
Escalating Data Theft
Prior to encryption, Gunra affiliates employ executables to collect files from platforms like OneDrive and SharePoint, compressing and transferring the data to cloud storage services such as Mega. They use common utilities like archive software, RClone, and FileZilla, which can blend into normal administrative activities, making behavior-based monitoring crucial. In one reported case, attackers exfiltrated 40 terabytes of data from a Dubai hospital.
Following data exfiltration, Gunra’s Windows encryptor processes files in parallel using ChaCha20 and RSA-4096 encryption algorithms, appending a new extension and leaving ransom notes in affected directories. The Linux variant can utilize up to 100 threads and allows operators to specify file types, encryption limits, and partial-encryption ratios, enabling tailored attacks. To hinder recovery efforts, attackers delete volume shadow copies and, in some instances, remove backup and archived data from both primary and disaster recovery sites before and after deploying the ransomware.
Organizations are advised to promptly patch affected FortiOS and FortiProxy systems, review administrator and VPN accounts, and invalidate suspicious sessions. Limiting RDP access, enforcing phishing-resistant multi-factor authentication, monitoring for unusual remote logins and directory activities, and securing backups with separate credentials and offline copies are critical steps in mitigating the threat posed by Gunra ransomware.
Gunra’s strategic use of stolen session data and legitimate remote management tools highlights the evolving sophistication of ransomware attacks. This underscores the necessity for organizations to adopt a multi-layered security approach, emphasizing proactive vulnerability management, continuous monitoring, and comprehensive incident response planning to effectively counter such advanced threats.
