Gunra Ransomware: What the Joint Advisory Says About Edge Devices, MFA Bypass and Recovery

On 10 August 2026, the FBI, CISA, NSA, DC3, the U.S. Secret Service and South Korea's National Police Agency published a joint advisory on Gunra, a ransomware-as-a-service operation that has been active since April 2025. Gunra is built on source code leaked from Conti in 2022, and it follows the double-extortion pattern: data is stolen before encryption, and victims are told it will be published on a Tor leak site if they do not pay.

The advisory is worth reading closely because it describes an intrusion chain that most defenders can map onto their own environment. The initial access is not exotic. It relies on internet-facing edge devices and credentials that were never rotated.

How the operators get in

The advisory names two Fortinet vulnerabilities used for initial access: CVE-2024-55591 and CVE-2025-24472. Both are in the CISA KEV catalog, which means exploitation was already observed before Gunra campaigns were attributed to them. The practical point is that these are not zero-days. They are known flaws on devices that frequently sit outside normal patch cycles.

Alongside the vulnerabilities, the operators use weak or reused VPN credentials and brute-force RDP access. That combination is why the advisory's mitigation list starts with patching internet-facing systems rather than with endpoint tooling.

What happens after the foothold

Once inside, Gunra affiliates move quickly and follow a recognizable pattern:

• they dump credentials from domain controllers and use pass-the-hash techniques to move laterally;
• they spread through RDP and SMB shares;
• they search file systems for stored secrets, and in at least one documented case took a symmetric encryption key from an access control server to unlock a large number of enterprise accounts;
• they modify authentication files on a VDI portal server so that a specific one-time password stays valid, which amounts to a server-level bypass of multi-factor authentication.

The MFA detail deserves attention on its own. Multi-factor authentication is usually described as a control that stops credential-based intrusion. Here the operators did not defeat the second factor by guessing it. They changed the server-side logic that validates it. If your MFA enforcement depends on files on a host you do not monitor for integrity, the control is only as strong as that host.

The Linux variant and its weakness

Gunra added a Linux encryptor that supports up to 100 parallel encryption threads, partial file encryption with an attacker-controlled ratio, and an option to store RSA keys in a separate keystore file. It combines RSA with ChaCha20 and is designed for speed on large file sets.

Researchers found a design flaw in that variant: the key material is generated with a weakly seeded time-based random generator. For some victims, file timestamps can be used to reconstruct the key and recover data without paying. This is a recovery opportunity, not a defense. It does not help organizations whose Windows estate was encrypted, and it does not reduce the value of the stolen data that is already exfiltrated.

What the advisory asks defenders to do

The authoring agencies list three priorities:

1. Patch known exploited vulnerabilities on internet-facing systems, including VPN gateways and RDP-exposed infrastructure.
2. Implement and test offline, immutable backups stored in a physically separate, segmented location.
3. Segment networks to restrict lateral movement from an initially compromised device.

Those are familiar recommendations, and the Gunra chain shows why each one carries weight. Patching closes the documented initial access path. Immutable backups determine whether encryption becomes an operational outage or a data-loss event. Segmentation limits how far a single compromised edge device can reach.

Two additions are worth making from the technical detail in the advisory. First, treat MFA configuration files and authentication logic on remote-access servers as integrity-monitored assets, because that is where the bypass happened. Second, audit VPN and RDP credentials for reuse and age, since the operators used both valid accounts and brute force.

Limits of what is known

The advisory does not publish a complete victim list, and the ransom demands reported by researchers vary widely, with some described as starting in the tens of millions of dollars. Sectors named in the advisory include healthcare, financial services, critical manufacturing, transportation, government, utilities, academia, media and retail. The leak site has listed victims across the Americas, Europe, the Middle East, Africa and Asia-Pacific.

What the advisory does not provide is a reliable indicator set that would let a defender detect Gunra purely by signature. The TTPs are the actionable part. Detection has to be built around credential dumping, unusual RDP and SMB lateral movement, and unauthorized changes to authentication configuration.

Conclusion

Gunra is a reminder that ransomware operations rarely depend on novel techniques. This one uses two patched-but-unapplied Fortinet flaws, weak VPN credentials, and a modification to an MFA validation file. The defensive work is unglamorous: patch the edge, rotate the credentials, monitor the authentication server, and prove that backups can actually be restored. The Linux variant's weak key generation may help some victims recover, but it is not a control anyone should plan around.

References

• FBI, CISA, NSA, DC3, USSS and KNPA, "#StopRansomware: Gunra Ransomware," AA26-222A, 10 August 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
• CISA Known Exploited Vulnerabilities catalog entries for CVE-2024-55591 and CVE-2025-24472.
• Trend Micro research on the Gunra Linux variant.