Listen to this Post
Introduction
A joint cybersecurity advisory from the FBI, CISA, the Department of Defense Cyber Crime Center, the NSA, the U.S. Secret Service, and South Korea’s National Police Agency has exposed a dangerous new wave of attacks by the Gunra ransomware group. Gunra is actively exploiting known Fortinet VPN vulnerabilities—specifically CVE-2024-55591 and CVE-2025-24472—to bypass multi-factor authentication, exfiltrate sensitive enterprise data, and lock down victim networks. First observed in April 2025 as a double-extortion variant built on leaked Conti source code, Gunra expanded into a full ransomware-as-a-service (RaaS) operation by early 2026, recruiting affiliates through dark web forums and even rebranding under the alias Golden Community.
Learning Objectives & Secrets
- Objective 1: Understand the Gunra Attack Chain – From initial exploitation of Fortinet authentication bypass flaws to MFA neutralization, lateral movement, credential dumping, and double-extortion encryption.
-
Objective 2 Secret Tip: MFA Is Not a Silver Bullet – Gunra bypasses MFA not by breaking the authentication factor itself, but by modifying authentication processing files on VDI portals to accept attacker-designated OTP values, effectively turning MFA into a one-password system. Security teams must audit authentication logic—not just enforce MFA.
-
Objective 3 Secret Tip: Patch the Entry Point, Then Hunt for Persistence – As one security expert noted, “Patching fixes the entry point. It does nothing about an authentication backdoor already embedded in the MFA flow”. Organizations must combine patching with active threat hunting for unauthorized modifications, unusual SSH tunneling, and Impacket-style lateral movement.
You Should Know
1. The Vulnerabilities: CVE-2024-55591 and CVE-2025-24472
Gunra affiliates gain initial access by exploiting two authentication bypass flaws in FortiOS and FortiProxy:
- CVE-2024-55591 – A critical flaw (CVSS 9.8, EPSS 98.26%) that allows a remote attacker to gain super-admin privileges via crafted requests to the Node.js websocket module. Affected versions: FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.x through 7.2.12.
-
CVE-2025-24472 – A high-severity vulnerability (CVSS 8.1) that allows a remote unauthenticated attacker with prior knowledge of upstream and downstream device serial numbers to gain super-admin privileges on the downstream device when Security Fabric is enabled.
Step-by-Step Patching Guide:
Linux / FortiGate CLI:
Check current FortiOS version get system status | grep "Version" Upgrade via CLI (ensure backup first) execute backup config tftp <filename> <tftp-server> execute restore image tftp <filename> <tftp-server> execute reboot
FortiGate Web Interface:
1. Navigate to System > Firmware
- Select Upload and choose the patched firmware image
3. Confirm upgrade and wait for reboot
Minimum patched versions:
- FortiOS: 7.0.17 or later
- FortiProxy 7.0.x: 7.0.20 or later
- FortiProxy 7.2.x: 7.2.13 or later
2. The MFA Bypass Technique: Authentication File Tampering
In one documented case, Gunra actors compromised an SSL-VPN administrator account protected by default credentials with no lockout controls. They then modified authentication processing files on a corporate VDI portal so that a Gunra-designated one-time password value would always authenticate successfully—effectively neutralizing MFA protections entirely.
Detection Commands (Linux / Windows):
Linux – Check for unauthorized modifications to authentication files:
Find recently modified authentication-related files in /etc find /etc -type f -mtime -7 -1ame "auth" -o -1ame "pam" -o -1ame "sshd" 2>/dev/null Check for unexpected sudoers modifications cat /etc/sudoers | grep -v "^" | grep -v "^$" Audit PAM configuration changes auditctl -w /etc/pam.d/ -p wa -k pam_changes ausearch -k pam_changes --start recent
Windows – Audit authentication file modifications (PowerShell):
Check for recently modified authentication-related files
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object { $<em>.LastWriteTime -gt (Get-Date).AddDays(-7) -and
($</em>.Name -match "auth|credential|password|mfa|otp") } |
Select-Object FullName, LastWriteTime
Check for unauthorized local user additions
Get-LocalUser | Where-Object { $_.Enabled -eq $true }
Audit Windows Event Log for authentication changes (Event ID 4720 - user creation)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4720} -MaxEvents 50
Monitor for unauthorized super-user accounts such as `forticloud-sync`.
3. Lateral Movement and Credential Dumping with Impacket
Once inside, Gunra operators leverage Impacket tools—psexec.py, smbclient.py, and secretsdump.py—to move across networks via SMB and dump credentials from domain controllers, enabling pass-the-hash and pass-the-ticket attacks. The group also uses SSH tunneling (OpenSSH) to establish encrypted connections between compromised systems and attacker-controlled servers.
Detection Commands:
Linux – Detect Impacket-style activity:
Check for unusual SMB connections netstat -antup | grep -E "445|139" Monitor for unusual Python processes (Impacket tools are Python-based) ps aux | grep -E "psexec|smbclient|secretsdump|wmiexec" Check for unexpected SSH tunnels ss -tunap | grep -E "ssh|:22" | grep ESTABLISHED Audit SSH authorized_keys for unauthorized entries cat ~/.ssh/authorized_keys
Windows – Detect lateral movement and credential dumping (PowerShell):
Check for unusual SMB connections
Get-1etTCPConnection -State Established | Where-Object { $<em>.LocalPort -eq 445 -or $</em>.RemotePort -eq 445 }
Monitor for Impacket-style process creation (Event ID 4688)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
Where-Object { $_.Message -match "psexec|smbclient|secretsdump|wmiexec" } |
Select-Object TimeCreated, Message
Check for unauthorized PowerShell remoting sessions
Get-PSSession | Where-Object { $<em>.State -eq 'Opened' -and $</em>.ComputerName -1e $env:COMPUTERNAME }
Network Segmentation Command (Linux iptables example):
Restrict SMB traffic to trusted subnets only iptables -A FORWARD -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT iptables -A FORWARD -p tcp --dport 445 -j DROP
4. Data Exfiltration: Cloud and File-Sharing Abuse
True to its double-extortion model, Gunra exfiltrates data before deploying its encryptor. Actors use a custom tool named `main.exe` to siphon files from Microsoft OneDrive and SharePoint, and move compressed archives—sometimes totaling tens of terabytes—to the file-sharing platform Mega. Open-source utilities including 7-Zip, RClone, and FileZilla support this collection and transfer process.
Detection Commands:
Windows – Detect large outbound transfers:
Monitor for RClone or FileZilla processes
Get-Process | Where-Object { $_.ProcessName -match "rclone|filezilla|7z" }
Check for large archive creation in unusual locations
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object { $<em>.Extension -match ".zip|.rar|.7z|.tar|.gz" -and
$</em>.Length -gt 1GB -and $_.LastWriteTime -gt (Get-Date).AddHours(-24) } |
Select-Object FullName, Length, LastWriteTime
Monitor network connections to cloud storage services
netstat -an | findstr "443" | findstr "mega|onedrive|sharepoint"
Linux – Detect data staging and exfiltration:
Monitor for RClone processes ps aux | grep rclone Check for large compressed archives in /tmp or other staging directories find / -type f -size +1G -mtime -1 2>/dev/null | grep -E ".(zip|rar|7z|tar|gz)" Monitor outbound connections to file-sharing platforms netstat -antup | grep -E "mega|onedrive|sharepoint"
5. The Encryption Payload: ChaCha20 + RSA-4096
The final Gunra payload uses ChaCha20 and RSA-4096 encryption across a multi-threaded architecture, appending the .ENCRT extension to locked files and dropping a ransom note—R3ADM3.txt—in every affected directory. Victims are pushed toward a Tor-based negotiation portal or the encrypted messaging app qTox, typically given five to seven days before Gunra threatens to leak or sell stolen data on its dedicated leak site. The group also deletes primary and disaster recovery backups to prevent restoration.
Windows – Detection and Response Commands:
Check for .ENCRT files across the network
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Extension -eq ".ENCRT" }
Check for ransom note R3ADM3.txt
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Name -eq "R3ADM3.txt" }
Monitor for VSS (Volume Shadow Copy) deletion attempts (Event ID 524)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=524} -MaxEvents 50
Check for shadow copy deletion (vssadmin)
NOTE: If you see this in logs, encryption has likely begun
Immutable Backup Configuration (Linux example with rsync to offline storage):
Backup to offline, immutable storage rsync -av --delete /critical/data/ /mnt/offline-backup/ Make backup read-only chmod -R 444 /mnt/offline-backup/ Disconnect storage after backup umount /mnt/offline-backup
6. CISA-Recommended Mitigations
The joint advisory urges organizations to:
- Prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure.
-
Implement and test offline, immutable backups stored in a physically separate, segmented location.
-
Segment networks to restrict lateral movement from an initially compromised device.
-
Enforce strong MFA and monitor for unauthorized modifications to authentication files.
-
Monitor for known Gunra-linked IP addresses, domains, and file hashes published in the CISA advisory’s indicators of compromise.
SIEM Monitoring Queries (Example – Splunk):
Detect unusual SSH tunneling index=network sourcetype=firewall dest_port=22 action=allow | stats count by src_ip, dest_ip Detect Impacket lateral movement patterns index=windows sourcetype=WinEventLog:Security EventCode=4688 | search CommandLine="psexec" OR CommandLine="wmiexec" OR CommandLine="secretsdump" Detect MFA bypass attempts (authentication without MFA challenge) index=windows sourcetype=WinEventLog:Security EventCode=4624 | where LogonType=10 AND NOT (AuthenticationPackageName="Microsoft Authenticator")
What Undercode Say
- Key Takeaway 1: Gunra demonstrates that MFA is only as strong as the infrastructure enforcing it. When attackers can modify authentication files on a VDI portal to accept attacker-designated OTP values, the MFA becomes a single-password system. Organizations must audit authentication logic itself, not just enforce MFA.
-
Key Takeaway 2: Patching is necessary but insufficient. As security experts have warned, patching fixes the entry point but does nothing about authentication backdoors already embedded in the MFA flow. Organizations must combine patching with active threat hunting for unauthorized modifications, unusual SSH tunneling, and Impacket-style lateral movement.
Gunra represents a evolution in ransomware operations—moving from simple encryption to sophisticated identity and access management compromise. The group’s ability to bypass MFA through authentication file tampering, intercept VPN traffic to steal session cookies, and delete offsite backups significantly elevates recovery time and security risk. The RaaS model, complete with a management panel, configurable builder, and cross-platform payloads, lowers the barrier for less-sophisticated actors. Organizations must treat VPN compromise as an incident requiring full investigation, not merely a patch ticket.
Prediction
-1 The Gunra ransomware campaign will continue to escalate throughout 2026 and into 2027 as the RaaS model attracts more affiliates. The group’s use of leaked Conti source code provides a mature, battle-tested codebase that reduces development overhead. With the group actively recruiting penetration testers and ethical hackers as initial access brokers, the volume of attacks is likely to increase.
+1 However, the joint U.S.-South Korea advisory and the publication of IOCs may enable defensive organizations to detect and block Gunra activity more effectively. The coordinated international response signals a growing willingness to share threat intelligence across borders.
-1 The most concerning development is Gunra’s demonstrated ability to bypass MFA through authentication file tampering—a technique that renders traditional MFA controls ineffective. This shifts the defensive burden from “enforce MFA” to “audit and protect authentication infrastructure,” a more complex and resource-intensive task.
-1 With Gunra operators now targeting cloud services including Microsoft OneDrive and SharePoint for exfiltration, organizations must extend their defensive posture beyond on-premises infrastructure. The encryption payload’s use of ChaCha20 and RSA-4096 across a multi-threaded architecture means that decryption without the private key is computationally infeasible. Offline, immutable backups remain the only reliable recovery path.
+1 The group’s five-to-seven-day ransom window provides a limited but actionable timeframe for incident response teams to contain, investigate, and recover—provided that detection occurs early in the attack chain.
For the latest indicators of compromise, refer to CISA Advisory AA26-222A at cisa.gov.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eUNVFCSk – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
