Gunra, the Conti-Derived Ransomware Group Now Exploiting Exposed Firewalls and VPNs

Joint Advisory and Threat Evolution

On August 10, 2026, CISA published advisory AA26-222A on Gunra ransomware, which was also featured in the August 14 threat roundup. In addition to CISA, the advisory was issued by the FBI, DoD Cyber Crime Center, NSA, U.S. Secret Service, and South Korea’s National Police Agency.

Gunra is a double-extortion ransomware family. Its operators steal data before encrypting systems, then threaten to publish or sell it if the victim refuses to pay.

The FBI first observed the group in April 2025. The malware appears to be derived from—or heavily influenced by—the Conti source code leaked in 2022. The group initially focused primarily on Windows environments, but intelligence gathered in mid-2025 indicated that it was developing a Linux variant and expanding toward cross-platform infrastructure.

Since January 2026, Gunra has also operated as a ransomware-as-a-service program. The group advertises the service on dark web forums and provides affiliates with a management panel, configurable builder, payloads for different systems, and operational documentation.

The operators also use the alias Golden Community. To gain initial access, they recruit penetration testers, ethical hackers, and other initial access brokers, offering them a share of the ransom in exchange for access to corporate networks.

Victims Across Numerous Sectors

Organizations listed on Gunra’s dedicated leak site are located in the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region. The total number of victims and the amount of ransoms demanded or paid remain unknown.

The affected sectors include:

• healthcare and public health;
• banking, finance, and insurance;
• critical manufacturing and construction;
• transportation and logistics;
• government agencies and facilities;
• utilities;
• universities and research organizations;
• media and communications;
• retail;
• professional services and nonprofit organizations.

The group’s operating model combines data theft and encryption. After exfiltrating data, the ransomware encrypts files and leaves a ransom note in every affected directory. The message provides instructions for accessing a negotiation portal over Tor, using a Client ID and an initial password.

Negotiations continue through qTox, an encrypted messaging application. The payment window generally ranges from five to seven days. If no agreement is reached, the operators threaten to publish or sell the data on their leak site.

Initial Access Through Exposed Appliances and Compromised Credentials

According to the FBI, Gunra primarily exploits known vulnerabilities in Internet-facing devices, including firewalls and VPN appliances. The advisory links this activity to MITRE ATT&CK technique T1190, Exploit Public-Facing Application.

The two vulnerabilities identified are:

• CVE-2024-55591, an authentication bypass classified as CWE-288, affecting specific versions of FortiOS and FortiProxy;
• CVE-2025-24472, also a CWE-288 authentication bypass affecting specific versions of FortiOS and FortiProxy.

The exact affected versions and builds were not disclosed in the available material. The product or vendor name alone is therefore insufficient to determine whether an appliance is vulnerable: the installed version must be compared with Fortinet’s guidance.

The operational severity of both flaws is high. CVE-2024-55591 has a CVSS score of 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It was added to the CISA KEV catalog on January 14, 2025; the remediation deadline for U.S. federal agencies was January 21, 2025.

CVE-2025-24472 has a CVSS score of 8.1, with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It was added to KEV on March 18, 2025, with an April 8, 2025 deadline for U.S. federal agencies.

Both vulnerabilities have been associated with ransomware campaigns. For CVE-2024-55591, CISA requires organizations to apply the vendor-provided mitigations or discontinue use of the product if no effective countermeasures are available. For CVE-2025-24472, it also recommends following the applicable BOD 22-01 requirements for cloud services.

The risk is not limited to CVEs. KNPA observed access obtained through exposed credentials and vulnerabilities in the SSH controls of VPN gateways published on the Internet. An unpatched appliance can therefore become an entry point even when the organization has not detected a direct attack against internal servers.

Recent developments reveal additional issues affecting the same vendors: CVE-2025-68686 was added to the KEV catalog on July 27, 2026. This does not indicate that Gunra is exploiting it, but it reinforces the need to treat exposed Fortinet technologies as priority assets for vulnerability management.

From Encryption to Lateral Movement

After gaining access, the operators attempt to expand their control over the network before launching encryption. For lateral movement, they regularly use the Impacket libraries, particularly psexec.py and smbclient.py.

This activity uses the Server Message Block protocol and is associated with MITRE ATT&CK technique T1021.002. Windows systems with accessible SMB shares, reused credentials, or excessive privileges can therefore facilitate propagation to other hosts.

The Windows encryptor uses native operating system APIs to locate data. To enumerate files and directories on available drives, it calls FindFirstFileW and FindNextFileW, scanning drive letters from A to Z. This behavior is mapped to technique T1106 – Native API.

Technical indicators extend beyond encrypted files. Telemetry showing anomalous access to firewalls and VPNs, unexpected SMB activity, execution of Impacket tools, and extensive drive scans can help identify the attack’s preparation phase.

Priority Defensive Measures

Organizations operating FortiOS or FortiProxy appliances should immediately verify installed versions, apply the vendor’s patches or mitigations, and remove from the network any devices for which no usable fixes are available.

The review should include:

1. firewalls, VPNs, and other appliances directly exposed to the Internet;
2. gateways with public SSH access;
3. privileged accounts and credentials that may have been exposed or reused;
4. authentication and configuration logs from Fortinet appliances;
5. anomalous SMB connections and unexpected use of psexec.py or smbclient.py;
6. RDP systems and publicly exposed infrastructure lacking adequate segmentation.

CISA provides the advisory’s indicators of compromise in STIX format: a 54 KB XML file and a 61 KB JSON file. The IOC data can be imported into SIEM, EDR, and network security monitoring systems to correlate domains, addresses, hashes, and other artifacts associated with the operation.

Patching and detection should be accompanied by offline, immutable backups stored in a physically separate and segmented location. Segmentation, in turn, limits propagation from a compromised endpoint to servers, hypervisors, ERP systems, and production resources.

Ransomware continues to target industry. In the second quarter of 2026, Dragos recorded 1,140 incidents affecting industrial organizations, 747 of them in the manufacturing sector. No cases of direct ICS manipulation were identified, but the attacks disrupted operations through IT systems, ERP platforms, and virtualization infrastructure.