Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption
Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption 1. Basic Information Severity : Critical Title : #StopRansomware: Gunra Ransomware (AA26-222A) Publishers : CISA / FBI / DC3 / NSA / USSS / Korean National Police Agency (KNPA) Publication Date : 2026-08-10 Original Source : https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a Primary PDF : https://media.defense.gov/2026/Aug/10/2003976697/-1/-1/0/CSA_STOPRANSOMWARE_GUNRA_RANSOMWARE.PDF Related Sources : NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/ BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ Related Malware, Groups, CVEs, and Products : Gunra, Golden Community, Conti variant, CVE-2024-55591, CVE-2025-24472, FortiOS, FortiProxy, SSL-VPN, VDI, Active Directory, Hiware, OneDrive, SharePoint, Mega, Sliver, Impacket, RClone 2. Executive Summary This is a double-extortion Ransomware-as-a-Service (RaaS) that enters networks through FortiGate/VPN authentication bypasses or default credentials. It modifies VPN traffic to steal sessions, implants static OTP backdoors into VDI authentication processes, steals dozens of terabytes of data from Active Directory, management servers, and SaaS platforms, and finally encrypts Windows and Linux systems. 3. Attack Flow Chain A: Fortinet-Initiated (Observed by FBI) Exploits CVE-2024-55591 or CVE-2025-24472 on internet-facing FortiOS/FortiProxy to bypass authentication. Gains access to the firewall/SSL-VPN and performs internal reconnaissance. Performs SMB lateral movement using Impacket's psexec.py or smbclient.py . Executes secretsdump.py on the domain controller to retrieve password hashes derived from NTDS.dit . Moves to privileged system accounts using pass-the-hash/pass