A joint U.S. and South Korean government advisory has warned that the Gunra ransomware operation is exploiting vulnerable Fortinet VPN appliances, weak remote-access controls, and exposed infrastructure to enter enterprise networks.
The ransomware-as-a-service, or RaaS, group has targeted organizations across government, healthcare, finance, manufacturing, transportation, utilities, education, media, and retail.
Gunra first appeared in April 2025 and is believed to be derived from the leaked Conti ransomware source code.
By early 2026, the operators had expanded into a structured affiliate program, advertising a ransomware builder, management panel, cross-platform payloads, and documentation on dark web forums.
The group follows a double-extortion model. Its affiliates steal sensitive information before encrypting files, then threaten to publish or sell the data through a dedicated leak site if the victim refuses to pay.
Negotiations are conducted through a Tor-based portal and the qTox encrypted messaging application, often with victims given five to seven days to respond.
Gunra Ransomware Bypasses VPN MFA
According to the advisory, Gunra affiliates primarily gain initial access by exploiting known vulnerabilities in internet-facing devices, particularly firewalls and VPN gateways.
The activity includes exploitation of FortiOS and FortiProxy authentication-bypass flaws tracked as CVE-2024-55591 and CVE-2025-24472.
The threat actors have also exploited credential exposure and SSH access-control weaknesses affecting internet-facing VPN systems.
In one incident, they accessed an SSL-VPN appliance administrator account by abusing default credentials where account-lockout protections were missing.
After reaching a compromised environment, Gunra operators use several methods to expand access.
They have used Impacket tools including psexec.py, smbclient.py, and secretsdump.py to move through networks over SMB, extract password hashes from Active Directory domain controllers, and perform pass-the-hash or pass-the-ticket attacks.
In another case, the attackers compromised an administrator workstation and used access to an SSL-VPN management console to identify an unused account connected to both external and internal networks.
They changed the account configuration to avoid a mandatory password-change requirement, then used it to access internal virtual desktop infrastructure.
| Category | Details |
|---|---|
| Threat name | Gunra ransomware |
| Model | Ransomware-as-a-Service (RaaS) with affiliate operations |
| First observed | April 2025 |
The group also captured credentials and session data by manipulating traffic-control functions on an SSL-VPN device. Stolen session cookies were subsequently used to hijack legitimate user sessions, CISA said.
Most concerningly, Gunra actors modified authentication-processing files on a corporate VDI portal. The alteration allowed access whenever a threat actor-controlled one-time password was entered, effectively creating a persistent MFA bypass.
The operation also deployed OpenSSH for tunneling and persistence, and stole encryption keys from an access-control server to decrypt passwords stored for enterprise server accounts.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
