Gunra RaaS: Six Intelligence Agencies Issue Emergency Alert as Conti’s Heir Exploits FortiGate Vulnerabilities — 51 Victims, $10M+ Ransom Demands

When six intelligence and law-enforcement agencies — CISA, the FBI, the NSA, the U.S. Secret Service, the Department of Defense Cyber Crime Center, and South Korea’s National Police Agency — issue a joint advisory in a single voice, the cybersecurity community stops what it is doing and pays attention. On 10 August 2026, that is exactly what happened, as advisory AA26-222A landed, warning the world about Gunra ransomware — a fast-growing ransomware-as-a-service (RaaS) operation that has already claimed 51 victims across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific region, with ransom demands exceeding ten million US dollars in most documented cases.

For CISOs, NOC leads, and IT security teams in India and the APAC region, this advisory carries a sharper edge than most: Gunra’s preferred front door is a pair of authentication-bypass vulnerabilities in Fortinet FortiOS and FortiProxy — the very infrastructure that underpins perimeter security across tens of thousands of Indian enterprises, government networks, and critical-infrastructure operators.

What Is Gunra Ransomware and Where Did It Come From?

Gunra first surfaced in April 2025, emerging from the same reservoir of leaked Conti source code that has spawned an entire generation of capable ransomware variants. Within a year, its operators had industrialised the operation: in January 2026, Gunra launched a formal RaaS affiliate programme on dark-web forums, complete with a browser-based management panel, a configurable ransomware builder producing cross-platform payloads, and structured documentation designed to onboard affiliates efficiently.

The group has also operated under the alias Golden Community. Notably, the advisory states that Gunra actors have actively recruited penetration testers and ethical hackers as initial-access brokers — a deliberate strategy that dramatically raises the sophistication floor across their affiliate pool and makes attribution more complex.

Technical Breakdown: How Gunra Breaks In and Burns Down

Gunra’s attack chain is methodical and brutally efficient. Understanding each stage is essential for building effective detections and controls.

Stage 1 — Initial Access via FortiOS and FortiProxy Exploits

The advisory confirms that CVE-2024-55591 and CVE-2025-24472 are the primary intrusion vehicles. Both flaws allow an unauthenticated remote attacker to obtain super-administrator privileges on the targeted appliance — effectively handing over the keys to the perimeter.

CVE	CVSS	Attack Vector	Affected Versions
CVE-2024-55591	9.8 Critical	Super-admin auth bypass via Node.js websocket on management interface	FortiOS 7.0.0–7.0.16; FortiProxy 7.0.0–7.0.19, 7.2.0–7.2.12
CVE-2025-24472	8.1 High	Super-admin auth bypass via crafted CSF proxy requests	FortiOS 7.0.0–7.0.16; FortiProxy 7.0.0–7.0.19, 7.2.0–7.2.12

CISA added CVE-2024-55591 to its Known Exploited Vulnerabilities (KEV) catalog with a January 2025 remediation deadline for U.S. federal agencies. Organisations still running the affected versions in August 2026 — over 18 months past that deadline — are operating on borrowed time. Beyond these CVEs, Gunra actors also exploit SSL-VPN appliances with default credentials and probe for any exposed management interface, making baseline hardening as important as patching.

Stage 2 — Credential Harvesting and Lateral Movement

Once inside, operators deploy Impacket tools — specifically psexec.py, smbclient.py, and secretsdump.py — to dump credentials from domain controllers and Active Directory NTDS databases. Stolen credentials and session cookies enable session hijacking of legitimate user accounts. MFA is actively bypassed by manipulating OTP flows on VDI portals, and SMB provides the lateral-movement highway between systems. The combination is fast and hard to stop once it is in motion.

Stage 3 — Cloud-Based Exfiltration to MEGA

Gunra operators deploy a custom executable — main.exe — that systematically collects data from OneDrive and SharePoint repositories, compresses it into archives, and uploads everything to MEGA. This cloud-based exfiltration route is particularly problematic because MEGA is a legitimate file-sharing service, making it difficult to block without disrupting legitimate business use.

Stage 4 — Encryption, Backup Destruction, and Double Extortion

Backup infrastructure is deleted both before and after encryption to eliminate recovery options. The payload uses stream ciphers (Salsa20 or ChaCha20) engineered for speed — the advisory notes the capability to encrypt 9 TB of data in a limited timeframe. Victims receive a ransom note with a 5–7 day payment window before stolen data appears on the group’s dark-web leak site. Ransom demands have exceeded USD $10 million in the majority of documented cases.

Critical advisory for Linux administrators: A March 2026 analysis uncovered a catastrophic cryptographic weakness in Gunra’s Linux variant. The encryption seed is derived from system time at the point of encryption — time-seeded randomisation — which makes the encryption mathematically reversible without paying the ransom. Linux victims should not pay; engage a specialised incident-response firm to leverage this weakness immediately.

Who Is Being Targeted — and Why India Should Be on High Alert

The advisory identifies a broad set of high-value sectors: healthcare and public health (hospitals, diagnostic chains, pharma manufacturers), financial services and insurance, government services, critical manufacturing and construction, transportation and logistics, utilities (power, water, telecom), as well as academia, media, retail, and professional services.

Among the 51 confirmed victims, South Korea, Brazil, Spain, Thailand, and Hong Kong appear with the highest frequency. The advisory explicitly covers the Asia-Pacific region — and India, with its enormous installed base of internet-facing FortiGate appliances securing enterprise, BFSI, and government networks, sits squarely within the blast radius of this campaign. As I covered in my earlier analysis of The Gentlemen ransomware, CVE-2024-55591 is already being weaponised by multiple independent threat actors simultaneously — Gunra is simply the largest and most operationally mature of them to date.

What You Should Do Right Now: Actionable Defence from Sanjay Seth

As a zero-trust architect and FortiGate specialist who has spent three decades hardening enterprise perimeters across India and the APAC region, here are concrete, prioritised actions — not generic advice.

1. Patch immediately and verify. If your FortiOS is on any version between 7.0.0 and 7.0.16, or FortiProxy between 7.0.0–7.0.19 or 7.2.0–7.2.12, you are vulnerable right now. Upgrade today. Refer to the Fortinet PSIRT advisory portal for the current patch matrix. After patching, verify the running version — do not assume the patch completed successfully without confirmation.
2. Disable management access from the internet. CVE-2024-55591 targets the management interface via the Node.js websocket module. If your FortiGate HTTPS management port is reachable from the public internet, lock it down to a dedicated management VLAN with strict source-IP ACLs — today, not during next month’s change window.
3. Audit and rotate all credentials immediately. Gunra actors use secretsdump.py against NTDS databases at scale. Assume that any domain administrator credential stored on or accessible from a Fortinet appliance may be compromised. Rotate service accounts, enforce a minimum password length of 20 characters for privileged accounts, and implement Privileged Access Workstations (PAWs) for all administrative sessions.
4. Enforce phishing-resistant MFA across all privileged access. Gunra explicitly bypasses time-based OTP on VDI portals. Move to FIDO2 or passkey-based MFA for all privileged accounts. Explore zero-trust reference architectures available on this site — FortiGate’s ZTNA capabilities provide an additional enforcement layer beyond traditional VPN.
5. Block MEGA and similar cloud exfiltration services. Unless your organisation has a documented business need for MEGA, block it at the perimeter firewall and proxy. Additionally, configure DLP rules to flag large outbound transfers to any cloud storage endpoint and alert your SOC team in real time.
6. Harden backup infrastructure with immutability. Gunra deletes backups before and after encryption. Apply the 3-2-1-1-0 backup rule: three copies, two different media types, one off-site, one air-gapped or immutable, zero unverified restores. Test your RTO and RPO quarterly under realistic ransomware-recovery conditions.
7. Deploy Impacket and lateral-movement detections in your SIEM. Push detection rules for psexec.py, smbclient.py, and secretsdump.py artefacts. Gunra’s TTPs are fully mapped to MITRE ATT&CK. Your SOC should be hunting for these proactively — reactive detection after encryption is too late. Refer to the Infosecurity Magazine analysis for detailed IOC references.

Frequently Asked Questions

Is Gunra the same as the Gentlemen ransomware that also exploited FortiGate CVEs?

No — Gunra and The Gentlemen are distinct and unrelated threat actors that independently weaponise the same FortiOS and FortiProxy vulnerabilities. The fact that multiple unrelated groups are actively exploiting these flaws simultaneously is precisely what makes patch priority so urgent for any deployment running affected versions.

Does Gunra only affect FortiOS 7.0.x, or are other versions at risk?

The advisory specifically identifies FortiOS 7.0.0–7.0.16 and the corresponding FortiProxy version ranges as vulnerable to CVE-2024-55591 and CVE-2025-24472. Other versions are not listed as affected by these specific CVEs. However, Gunra operators also target SSL-VPN appliances using default credentials and exposed management interfaces — attack vectors that are version-agnostic. A full hardening review is warranted regardless of FortiOS version.

If our Linux servers were hit by Gunra, should we pay the ransom?

Definitively no. Security researchers identified a fundamental flaw in Gunra’s Linux payload: the encryption key is seeded from system time at the point of encryption, making it mathematically reversible. Engage a specialised incident-response firm that can exploit this weakness to recover your data. Paying the ransom is unnecessary, and paying also funds further attacks on other organisations.

How do we determine if we have already been compromised?

Indicators to hunt for include: unexpected FortiOS management-interface authentication events from IPs outside your approved management range; Impacket tool artefacts (psexec.py, secretsdump.py) in Windows Security and System event logs; large or unexpected outbound transfers to MEGA.nz; deletion of VSS shadow copies or backup catalogue files; and anomalous SMB lateral-movement patterns between servers outside of normal business hours. If you observe any of these, escalate to your incident-response team immediately and do not attempt to patch live in a potentially compromised environment.

Secure Your Organisation Before the Next Victim Is Named

Advisory AA26-222A represents the most credible level of warning available short of an active incident on your own network. Six agencies do not jointly publish an advisory for a marginal or theoretical threat. Gunra is real, operationally mature, actively recruiting, and specifically targets the Fortinet infrastructure that protects your organisation.

Whether you need a rapid FortiGate patch-status and configuration audit, a zero-trust architecture review for your NOC and SOC, a ransomware tabletop exercise for your leadership team, or a full incident-response retainer, I am here to help — and the conversation starts with a single message. Request your no-obligation security assessment today — before Gunra finds your organisation first.