{
"title_fr": "Ransomware Gunra: the gang bypasses multi-factor authentication by exploiting Fortinet vulnerabilities",
"excerpt_fr": "U.S. and South Korean agencies publish a joint alert detailing the tactics of the Gunra group, a Conti-derived ransomware that exploits critical vulnerabilities on Fortinet devices and bypasses MFA by manipulating VDI authentication portals.",
"content_fr": "## An unprecedented joint alert\n\nOn August 10, 2026, the FBI, CISA, NSA, U.S. Secret Service, Department of Defense Cyber Crime Center (DC3), and the National Police Agency of South Korea (KNPA) issued a joint alert — referenced AA26-222A — dedicated to the ransomware Gunra. This technical document outlines the tactics, techniques, and procedures (TTP) of a group that emerged in April 2025 and has since significantly expanded its operations, notably through a RaaS (Ransomware-as-a-Service) program launched in January 2026 on dark web forums.\n\n> \"Gunra is another variant in the ongoing trend of ransomware attacks causing disruptions and damage to U.S. and international organizations,\" said Chris Butera, acting deputy executive director of CISA for cybersecurity.\n\nTargeted sectors include healthcare, financial services, critical infrastructure, government services, transportation, energy, retail, and professional services. According to data from Ransomware.Live, 51 victims have been recorded since the group's emergence, primarily in South Korea, Brazil, Spain, Thailand, and Hong Kong, with a concentration in Australia, East Asia, and Europe.\n\n## Fortinet vulnerabilities as an entry point\n\nAccording to the CISA advisory, Gunra actors obtain their initial access primarily by exploiting known vulnerabilities on devices exposed to the Internet, including firewalls and VPN gateways. Two specific CVEs are mentioned:\n\n- CVE-2024-55591 — an authentication bypass vulnerability affecting certain versions of FortiOS and FortiProxy (CWE-288).\n- CVE-2025-24472 — a second authentication bypass vulnerability, also on FortiOS and FortiProxy.\n\nThe Hacker News additionally reports that the group may have also exploited the CVE-2024-5559 vulnerability affecting Schneider Electric PowerLogic P5 devices exposed to the Internet, a vector that does not explicitly appear in the CISA advisory but has been observed in certain campaigns.\n\nIn some cases, the KNPA also observed attackers exploiting default credentials on SSL-VPN appliances when account lockout controls were not enabled.\n\n## Bypassing MFA: a particularly sophisticated technique\n\nOne of the most concerning aspects of the alert pertains to the techniques employed by Gunra to bypass multi-factor authentication (MFA). The KNPA has documented several methods:\n\n1. SSL-VPN traffic interception: attackers manipulated the network traffic control feature of an SSL-VPN appliance to intercept credentials and session information transmitted by users authenticating on an enterprise VDI authentication portal.\n2. Session hijacking: stolen session cookies were used to conduct session hijacking attacks, masquerading as legitimate users to access the internal network.\n3. Modification of authentication files: attackers altered the authentication processing files on the VDI portal server so that a specific OTP value designated by Gunra triggers a successful authentication — a permanent and silent bypass of MFA.\n\nThis approach demonstrates that the actors do not merely exploit network vulnerabilities: they sufficiently understand the target authentication architecture to sabotage it from the inside after gaining initial access.\n\n## Once inside: lateral movement and massive exfiltration\n\nGunra's attack pattern is methodical. After the initial access, attackers use the Impacket suite — notably psexec.py and smbclient.py — to move laterally via the SMB protocol. The secretsdump.py tool is employed to extract password hashes from the NTDS file of compromised domain controllers, allowing for pass-the-hash or pass-the-ticket attacks.\n\nMalicious activities are conducted from 10 PM to 6 AM to evade detection, and attackers systematically clean access logs and command histories. In one documented case, the actors connected to the VDI environments of IT staff to collect sensitive network and system configuration documents.\n\nData exfiltration occurs via an executable named main.exe targeting Microsoft OneDrive and SharePoint. In at least one case, attackers created compressed archives containing up to multiple terabytes of data and uploaded them to the MEGA service. Open-source tools 7-Zip, RClone, and FileZilla were also used.\n\n## Encryption: ChaCha20 + RSA-4096\n\nThe Windows binary of Gunra uses a multithreaded architecture allowing for the parallel encryption of multiple files with ChaCha20 + RSA-4096. The ransomware scans all accessible drives (A to Z), filtering critical system directories (C:\\Windows, C:\\Program Files) and certain extensions (.exe, .dll, .sys). Encrypted files receive the extension .ENCRT (and .CRYPT in a July 2025 sample), and a ransom note named R3ADM3.txt is placed in each affected directory.\n\nBefore encryption, attackers delete volume snapshots via WMI and do not hesitate to destroy backups in both the main data center and the disaster recovery center.\n\n## A Conti legacy and a possible North Korean connection\n\nGunra is based on — or heavily influenced by — the source code of Conti, the ransomware whose sources leaked in 2022. Since then, the group has launched a structured RaaS program, offering affiliates a management panel, a configurable ransomware builder, cross-platform payloads (Windows and Linux), and affiliate documentation.\n\nThe FBI has also observed the group adopting a new alias, \"Golden Community\", and actively recruiting pentesters and ethical hackers as initial access brokers, in exchange for a share of the ransom profits.\n\nA particularly interesting point raised by The Hacker News: analyses from AhnLab suggest commonalities between Gunra and an unidentified state-sponsored group linked to North Korea. Watering hole campaigns exploited a zero-day vulnerability in AnySign4PC certificate signing software, and some distributed payloads — Struggle (alias SIGNBT 3.0) and Brandoor (alias COPPERHEDGE) — are associated with the Lazarus Group. While Gunra and state-sponsored groups appear to be distinct actors with different objectives, these similarities suggest possible sharing of techniques, tools, or infrastructure.\n\nThis type of collaboration is not unprecedented: as early as October 2024, Palo Alto Networks Unit42 observed the Andariel (Lazarus) sub-cluster partnering with the Play ransomware group. Since September 2025, Lazarus and Moonstone Sleet have also been attributed to attacks using the Qilin and Medusa ransomware.\n\nFurthermore, in March 2026, Breakglass Intelligence identified a \"catastrophic cryptographic weakness\" in Linux versions of Gunra, allowing for the recovery of the encryption key and regaining access to files — a flaw that the group may have since patched.\n\n## Recommendations\n\nCISA recommends organizations to:\n\n- Prioritize patching known and exploited vulnerabilities on systems exposed to the Internet, including VPN gateways and RDP infrastructures;\n- Implement and test offline, immutable backups stored in a physically separate and segmented location;\n- Segment networks to limit lateral movement from an initially compromised device;\n- Monitor for the use of legitimate tools hijacked by Gunra: Impacket, Mimikatz, AnyDesk, RClone, FileZilla, Sliver, among others.\n\nThe complete advisory, including indicators of compromise (IOC) in STIX format, is available on the CISA website.\n\n## In summary\n\nThe joint alert on Gunra illustrates a mature ransomware, derived from proven code (Conti), which combines exploits of known vulnerabilities with sophisticated MFA bypass techniques. The fact that six agencies — American and South Korean — are coordinating to publish this document shows the scale of the threat. Organizations with Fortinet appliances exposed to the Internet should ensure that patches for CVE-2024-55591 and CVE-2025-24472 are applied, as these vulnerabilities remain the preferred entry vector for the group.",
"image_path": "/uploads/20260812_ff9e9997573a.jpg",
"source_urls": [
"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a",
"https://thehackernews.com/2026/08/gunra-ransomware-exploits-fortinet-and.html",
"https://www.bleepingcomputer.com/news/security/",
"https://therecord.media/",
"https://www.darkreading.com/cyberattacks-data-breaches/gunra-ransomware-gang-fortinet-flaws-bypasses-mfa"
]
}