FBI and CISA: Gunra Expands RaaS with Fortinet Exploits and MFA…

On August 10, 2026, the FBI, CISA, NSA, Secret Service, DC3, and South Korea's KNPA released joint advisory AA26-222A on Gunra, a ransomware-as-a-service operation derived from leaked Conti source code. The advisory details how the group, first observed in April 2025, formalized an affiliate program by January 2026 with a management panel, configurable builder, and cross-platform payloads. The attack chain exploits known vulnerabilities in Fortinet appliances, compromises the infrastructure delivering multi-factor authentication, and culminates in exfiltration of up to tens of terabytes.

Key Takeaways

Gunra operates as a structured RaaS under the alias "Golden Community," targeting victims across the Americas, Europe, Middle East, Africa, and Asia-Pacific.
Initial access focuses on CVE-2024-55591 (CVSS 9.6, CRITICAL) and CVE-2025-24472 (CVSS 8.1, HIGH), authentication bypass flaws in FortiOS/FortiProxy.
Actors bypass MFA by modifying authentication files on VDI servers, compromising the infrastructure that delivers MFA rather than the protocol itself.
The Linux variant supports up to 100 parallel encryption threads; initial ransom demands have reached tens of millions of dollars with a 5-7 day deadline.

How Gunra's RaaS Model Works

The joint advisory describes Gunra as an operation with a formalized affiliate structure. By January 2026, the group had launched a program on dark web forums providing affiliates access to a management panel, a configurable ransomware builder, and cross-platform locker payloads. This architecture lowers the barrier to entry for less sophisticated operators, amplifying the potential volume of attacks.

The group also operates under the alias "Golden Community." Victims documented on the data leak site span the Americas, Europe, Middle East, Africa, and Asia-Pacific. Target sectors include healthcare, financial services, critical manufacturing, transportation, government, utilities, academia, media, and retail. According to the advisory, this breadth reflects RaaS logic: targets are selected by affiliates, not centrally by the core group.

The Attack Chain: From Fortinet to MFA Bypass

Initial access documented by the FBI centers on two N-day vulnerabilities in Fortinet devices. CVE-2024-55591, with a CVSS score of 9.6 per the official cve.org record, allows authentication bypass with super-admin privileges. CVE-2025-24472 carries a CVSS score of 8.1 and is rated HIGH. Both have been known for months: the paradox is that Gunra systematically exploits them against organizations that have not applied available patches.

The KNPA also observed the use of exposed credentials and SSH vulnerabilities in VPN gateways. In one documented case, actors compromised an SSL-VPN appliance by exploiting default credentials with absent lockout controls. This scenario requires no sophisticated exploit: it is RaaS automation applied to the most elementary attack surface.

Lateral movement uses tools from the Impacket suite: psexec.py and smbclient.py over SMB. The inflection point in the chain is the MFA bypass. According to the report, actors modified authentication files on the corporate VDI server to allow access when a specific OTP designated by Gunra was entered. Umut Bayram, research engineer at Picus Security, summarized the pattern: the group "goes looking for reusable authentication material at every step."

Exfiltration, Encryption, and Monetization

Data exfiltration includes business-critical documents, databases, PII, and internal emails. In one case, volume reached tens of terabytes transferred via OneDrive and SharePoint to the Mega service. The STIX XML indicator published by CISA identifies main.exe as the executable used for exfiltration from Microsoft OneDrive and SharePoint.

Encryption uses ChaCha20 with an RSA-4096 key. The Linux variant, documented by The Register, supports up to 100 parallel encryption threads and implements partial encryption. This technical architecture enables deployment on servers and cloud infrastructure, beyond traditional Windows endpoints.

Initial ransom demands have reached tens of millions of dollars, according to Cybernews. Negotiations occur via a Tor portal and qTox, with a 5-7 day deadline before stolen data is published. The double-extortion model is integrated: the threat of publication adds pressure beyond system encryption.

"The Fortinet vulnerabilities may have given Gunra an initial foothold in victim environments, but ransomware is never just about the front door. Once inside, these attackers steal credentials, move laterally, bypass MFA, and ultimately reach critical systems before deploying ransomware" — Etay Maor, VP Threat Intelligence, Cato Networks

What to Do Now

Organizations with internet-exposed Fortinet devices must immediately verify patch status for CVE-2024-55591 and CVE-2025-24472. The joint advisory provides STIX IOCs in XML and JSON formats with SHA-256 hashes, onion domains, and IP addresses associated with the operation: these indicators must be integrated into detection systems.

The documented MFA bypass requires a review of authentication architecture. Multi-factor authentication remains effective when the protocol is uncompromised, but security collapses if the infrastructure delivering it is controlled by the attacker. VDI servers must be segmented and the principle of least privilege applied to authentication infrastructure components as well.

Monitoring of SMB lateral movement with tools like Impacket must be prioritized. The suite is legitimate, but its presence in environments where it is not planned administrative activity is an indicator of compromise.

Finally, backups must be isolated from the primary network and tested for recovery capability. The RaaS model with a Linux variant and 100-thread parallel encryption drastically reduces the time window between infection and data irrecoverability.

What Remains Outside the Picture

The advisory does not identify the group's country of origin. No infrastructure overlap emerges linking Gunra to other Fortinet operations such as FortiBleed. Affiliate profit-sharing percentages are not specified. The presence or absence of a definitive patch for CVE-2025-24472 is not verified in available sources. The exact total number of victims is not officially quantified.

The Perimeter Defense Paradox

Gunra demonstrates a disturbing mechanism: the perimeter did not fall for lack of technology, but for excess trust in its application. The vulnerabilities were known, patches existed, MFA was active. Yet the chain worked because the perimeter was breached, authentication was nullified by compromising the server that provided it, and defense-in-depth reduced to a series of controls that trusted each other recursively. RaaS does not make attackers more sophisticated: it makes the systematic use of what already works scalable.

Frequently Asked Questions

Is Gunra linked to the Conti group? No. Conti has been defunct since 2022. Gunra uses leaked Conti source code as a technical base, but no evidence exists of operational or personnel continuity.

Why was MFA bypassed if it is considered secure? The MFA protocol was not violated. Attackers compromised the VDI server managing authentication, modifying processing files to accept an OTP they designated. It is an attack on the infrastructure, not the algorithm.

What is the mitigation priority? Verifying patch status for CVE-2024-55591 is the first action, given its CVSS 9.6 score and documented use as the primary initial access vector.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references

Get DeafLetter