Top Highlights
- A new ransomware group, Gunra, is exploiting known vulnerabilities and employing a double-extortion ransomware based on leaked Conti source code to target critical infrastructure worldwide.
- Gunra is actively leveraging Fortinet security flaws (CVE-2024-55591 and CVE-2025-24472) for initial access, despite these vulnerabilities being widely known and unpatched in many organizations.
- The group conducts sophisticated attacks including session hijacking, MFA bypass, and deleting backups, mainly targeting organizations in healthcare, finance, manufacturing, and government sectors across multiple continents.
- Authorities recommend patching vulnerabilities, securing backups, and implementing network segmentation to mitigate the risks posed by Gunra and similar ransomware operations, which facilitate lower-skilled cybercriminals through support and ready-made tools.
Gunra Ransomware Exploits Known Fortinet Flaws to Bypass Security Measures
Recently, a ransomware gang called Gunra has been using weaknesses in Fortinet products to gain access to networks. This gang targets important organizations like hospitals, banks, and government offices. They use two specific vulnerabilities in Fortinet tools, which many organizations have not yet fixed. These holes allow the hackers to go past security barriers and take control of systems.
The FBI observed that Gunra used these flaws to break into systems, even beating multi-factor authentication (MFA). For example, they hijacked sessions on Virtual Desktop Infrastructure (VDI) portals by stealing login cookies. What makes this dangerous is that they can bypass the second layer of security that most organizations rely on. They also deleted backups and stole important data, making recovery harder and increasing their leverage for ransom demands.
Who is Behind Gunra and How Are They Operating?
Gunra appeals to cybercriminals by offering easy-to-use tools and instructions on the Dark Web. This makes it easier for less skilled hackers to join the group’s activities. The ransomware operation has a structured program where affiliates can earn money by carrying out attacks. This approach helps the gang target multiple regions worldwide, especially in South America, Asia, and Europe.
There are also signs of a possible connection with a state-sponsored threat group targeting South Korea. Experts believe that Gunra might share some tools and techniques with more advanced attackers, possibly even collaborating at times. The advisory advises organizations everywhere to fix known vulnerabilities, strengthen their backup systems, and prevent hackers from moving laterally within their networks.
Discover More Technology Insights
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
CyberRisk-V1
