Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

Overview

A joint advisory issued August 10, 2026 by CISA, the FBI, NSA, the Department of Defense Cyber Crime Center (DC3), the U.S. Secret Service, and South Korean government partners warns of an active and growing ransomware threat: Gunra. The advisory — designated AA26-222A — documents the group's targeting of critical infrastructure worldwide and urges immediate action to patch two critical Fortinet vulnerabilities being actively exploited.

As of the advisory's publication date, Gunra had publicly claimed 51 victims on its Tor-based leak site, concentrated across South Korea, Brazil, Spain, Thailand, and Hong Kong. Affected sectors include healthcare, financial services, government, manufacturing, transportation, education, and utilities.

Background: Who Is Gunra?

Gunra is a Ransomware-as-a-Service (RaaS) operation that first emerged in April 2025. Researchers believe it is derived from the leaked Conti ransomware source code — the same codebase that gave rise to several major RaaS groups following Conti's operational collapse in 2022. The group also operates under the alias "Golden Community."

By January 2026, Gunra had formalized its affiliate program on dark web forums, advertising:

• A configurable ransomware builder with cross-platform payloads (Windows primary, Linux introduced mid-2025)
• A centralized management panel for affiliates
• Structured documentation and onboarding for new criminal operators

The group employs a double extortion model: data is exfiltrated before encryption, and victims receive a 5–7 day ultimatum to pay ransoms typically exceeding $10 million USD. Failure to pay results in stolen data being published on the group's Tor leak portal. The FBI has observed Gunra affiliates making direct contact with victim executives and management staff via email as additional pressure.

Exploited Vulnerabilities

Gunra's primary initial access vector is exploitation of two critical Fortinet vulnerabilities affecting FortiOS and FortiProxy — firewall and VPN appliances widely deployed across enterprise and government networks:

Both vulnerabilities allow unauthenticated attackers to bypass authentication on internet-facing appliances, giving them a direct foothold into protected networks without valid credentials. These flaws were patched by Fortinet but remain unpatched in a significant number of deployed appliances.

Attack Chain and TTPs

Once inside a network, Gunra affiliates follow a well-documented playbook:

Lateral Movement: The group leverages Impacket — a popular Python toolkit used by both legitimate administrators and attackers — including tools such as psexec.py, smbclient.py, and secretsdump.py to move laterally over SMB and harvest Active Directory credentials via pass-the-hash and pass-the-ticket attacks.

MFA Bypass: In several incidents, Gunra affiliates were observed tampering directly with authentication configuration files on VPN and VDI systems, disabling or circumventing multi-factor authentication protections on systems that had it configured.

Backup Destruction: Prior to and immediately following ransomware deployment, the group systematically deletes backup and disaster recovery data to eliminate recovery options and maximize victim pressure.

Encryption: Gunra uses advanced stream ciphers — Salsa20 or ChaCha20 — capable of encrypting up to 9TB of data within limited operational timeframes, making rapid detection critical.

Note on Linux Variant: Researchers discovered in March 2026 that a weakness in Gunra's Linux ransomware variant allows defenders to reconstruct encryption keys using file timestamps, potentially enabling file recovery without ransom payment. Organizations with Linux-hosted data should preserve all metadata and engage forensic specialists before concluding that data is unrecoverable.

Recommended Mitigations

CISA and the FBI recommend the following immediate actions:

1. Patch CVE-2024-55591 and CVE-2025-24472 on all Fortinet FortiOS and FortiProxy appliances without delay.
2. Audit VPN and VDI authentication files for unauthorized modifications that could indicate MFA bypass attempts.
3. Implement network segmentation to limit lateral movement if an attacker gains initial access.
4. Maintain offline, immutable backups in physically separate locations not reachable from the primary network.
5. Monitor for Impacket tool usage on the network — specifically psexec.py and secretsdump.py activity targeting domain controllers.
6. Enable MFA on all remote access systems and verify that MFA configurations have not been tampered with.
7. Restrict SMB access across the network and enforce Active Directory credential hygiene.

Takeaway

Gunra represents the continued commoditization of ransomware operations through the RaaS model, lowering the barrier to entry for affiliates while concentrating technical development in a single group. The exploitation of unpatched Fortinet appliances — a recurring theme in 2025 and 2026 breach investigations — underscores a fundamental challenge: perimeter devices designed to protect networks frequently become the attack entry point when patch cycles lag.

Organizations that have not yet applied patches for CVE-2024-55591 and CVE-2025-24472 should treat this as an emergency action item. The advisory's multi-agency backing signals that these attacks are assessed as an ongoing and escalating threat to critical infrastructure globally.