Listen to this Post
A Dangerous Ransomware Operation Is Learning From
Ransomware has changed. The most dangerous attacks no longer depend entirely on discovering a brand-new zero-day vulnerability. Increasingly, criminal groups are finding that old, publicly documented weaknesses can be just as powerful when organizations fail to patch them, expose vulnerable appliances to the internet, or assume that multifactor authentication alone will stop an intruder.
Gunra is a particularly worrying example of this evolution.
According to a joint cybersecurity advisory from US and South Korean authorities, the Gunra ransomware operation has been exploiting known vulnerabilities in Fortinet firewall and VPN products to gain initial access. From there, affiliates have demonstrated the ability to steal authentication material, hijack sessions, circumvent MFA, manipulate authentication systems, destroy backups, and ultimately deploy ransomware.
The story is bigger than Gunra itself. It highlights a fundamental weakness in modern enterprise security: an organization can have strong security controls on paper and still lose if attackers compromise the infrastructure sitting underneath those controls.
Gunra’s emergence also shows how ransomware-as-a-service continues to industrialize cybercrime. Instead of every criminal group needing advanced malware development skills, affiliates can obtain ransomware builders, documentation, management panels, and operational guidance from an organized criminal ecosystem.
The result is uncomfortable but increasingly familiar: attack sophistication is becoming available as a service.
Gunra Emerged as a Conti-Inspired Ransomware Operation
Gunra first appeared in the spring of 2025 and initially focused primarily on Windows environments.
Investigators later identified a Linux variant, suggesting that the operation was expanding its ability to reach different enterprise environments and infrastructure. By early 2026, Gunra had reportedly developed a structured RaaS affiliate program advertised on underground forums.
The ransomware itself has been described as a sophisticated double-extortion operation based on leaked source code associated with the now-defunct Conti ransomware group.
That heritage matters.
Conti was one of the most influential ransomware organizations of its era, and leaked ransomware source code effectively became a blueprint that other criminal actors could study, modify, and reuse.
Gunra demonstrates how the collapse of one ransomware organization does not necessarily mean the disappearance of its capabilities.
Instead, the knowledge can spread.
Ransomware Has Become an Ecosystem, Not a Single Hacker Group
Traditional ransomware attacks were often portrayed as a small group of attackers breaking into a network, encrypting files, and demanding money.
Modern RaaS operations look much more like businesses.
Developers create malware. Operators maintain infrastructure. Affiliates conduct intrusions. Initial-access brokers may sell compromised credentials. Data theft specialists collect sensitive information. Negotiators may communicate with victims.
Each participant can specialize.
This division of labor makes ransomware more scalable because an attacker does not need to understand every part of the operation.
Gunra’s affiliate model reportedly provides documentation, ransomware-building capabilities, and an administrative panel, lowering the technical barrier for criminals who may not possess advanced malware-development skills.
That is one of the most important developments to watch.
Fortinet Vulnerabilities Are Becoming a Ransomware Gateway
The joint advisory highlighted two Fortinet vulnerabilities used by Gunra affiliates for initial access.
The first is CVE-2024-55591, a critical authentication-bypass vulnerability affecting FortiOS and FortiProxy.
The vulnerability can allow attackers to obtain highly privileged access to affected Fortinet appliances.
The second is CVE-2025-24472, another authentication-bypass vulnerability affecting FortiOS and FortiProxy.
Both vulnerabilities have previously attracted significant attention from attackers, including ransomware operators.
The lesson is painfully simple: a vulnerability does not become harmless merely because it is no longer new.
An old flaw sitting on an internet-facing firewall can remain a front door into an organization months after security researchers first disclosed it.
The Real Problem Is Not the Age of the Vulnerability
Security teams sometimes unconsciously divide vulnerabilities into two categories: new and dangerous, or old and less urgent.
That is a dangerous assumption.
For attackers, the more important question is often:
Does the vulnerability still work?
If the answer is yes, its age is almost irrelevant.
A vulnerability that was disclosed eighteen months ago but remains exposed on a critical VPN appliance can be more useful to a criminal than a recently discovered flaw that has already been mitigated across most organizations.
Gunra appears to understand this reality.
Internet-Facing Appliances Are Prime Targets
Firewalls, VPN gateways, remote-access appliances, and identity infrastructure are unusually attractive targets because they sit at the boundary between the internet and the corporate network.
Compromise one of these systems, and attackers may not need to defeat every security product inside the organization.
They may simply enter through the infrastructure that is trusted to let legitimate users in.
This creates a dangerous asymmetry.
The defender must protect thousands of endpoints, identities, applications, servers, and network components.
The attacker may only need to find one vulnerable gateway.
Gunra Did Not Simply Bypass MFA
One of the most disturbing parts of the advisory involves Gunra’s abuse of authentication mechanisms.
In one observed attack, affiliates compromised an SSL-VPN appliance and used traffic-control capabilities to collect credentials and session information belonging to employees authenticating to a corporate VDI portal.
The attackers then used stolen session cookies for session hijacking.
This distinction is extremely important.
The attackers did not necessarily need to “break” MFA cryptographically.
Instead, they targeted the authentication process around it.
Session Cookies Can Become Digital Skeleton Keys
A session cookie can represent an already authenticated session.
If an attacker steals a valid session token, they may be able to impersonate the user without repeating the entire authentication process.
This creates a fundamental problem for organizations that think about MFA as a single checkpoint.
MFA can strongly protect the login event while doing little to protect a session that has already been authenticated and subsequently stolen.
That is why modern identity security must consider the entire session lifecycle.
Authentication is not the end of security.
It is the beginning.
Gunra Also Modified Authentication Processing
The advisory describes an even more serious technique.
For one victim, Gunra actors modified authentication-processing files on the corporate VDI authentication portal.
The attackers configured the system so that a specific attacker-controlled one-time password value could result in successful authentication.
In practical terms, they created a mechanism that allowed them to repeatedly bypass the organization’s MFA protections.
This is far more dangerous than simply stealing a password.
The attackers attempted to alter the authentication system itself.
When the Authentication System Becomes the Target
This incident exposes a critical principle in enterprise security:
Identity infrastructure must be treated as high-value security infrastructure.
Organizations often concentrate heavily on endpoint detection, antivirus, email security, and perimeter firewalls.
But if an attacker obtains privileged access to the system responsible for authenticating users, many downstream security controls can become easier to defeat.
An attacker who controls authentication logic does not necessarily need to impersonate every user individually.
They can potentially manipulate the mechanism that decides whether a user is trusted.
Gunra Appears Obsessed With Reusable Authentication Material
Security researchers have highlighted another recurring feature of Gunra operations: the collection of reusable authentication material.
That can include operating-system credentials, authentication databases, passwords, session information, encryption keys, and other secrets.
The objective is straightforward.
Find something that can be reused.
A stolen password may unlock another system.
A stolen cookie may provide access to an existing session.
A stolen encryption key may reveal stored credentials.
A compromised identity server may provide an entirely different level of access.
Attackers are therefore not necessarily interested in one credential.
They are interested in the credential ecosystem.
The Hiware Incident Shows How Deep Credential Theft Can Go
In another observed attack, Gunra affiliates reportedly compromised a Hiware access-control server and extracted an encryption key that allowed them to decrypt passwords stored in its database.
This illustrates a broader problem with credential storage.
Encrypted credentials are not automatically safe simply because they are encrypted.
If attackers obtain the encryption key or compromise the application responsible for decrypting the information, protected secrets can potentially become readable.
The security of stored credentials therefore depends on much more than the database itself.
Gunra Is Also Attacking the Backup Strategy
Ransomware operators know that encryption is not always enough.
If victims have reliable backups, they can potentially restore systems without paying.
That is why modern ransomware groups increasingly attack backups before or during encryption.
The Gunra advisory described an incident in which affiliates deleted backups and archived data stored in both the primary data center and disaster-recovery environment.
This is an especially serious tactic.
A backup that can be remotely deleted by an attacker is not truly independent from the production environment.
Disaster Recovery Is Not the Same as Backup
Many organizations proudly maintain disaster-recovery systems.
But a disaster-recovery environment connected to the same identity infrastructure, administrative accounts, or network controls as production can potentially be compromised alongside the primary environment.
That means the question should not simply be:
Do we have backups?
The better questions are:
Can attackers reach them?
Can compromised administrators delete them?
Can ransomware credentials access them?
Have we actually tested restoration?
The difference between having a backup and having a recoverable backup can determine whether a ransomware incident lasts hours or weeks.
Gunra Targets Critical Infrastructure Across Multiple Sectors
Gunra’s victims reportedly include organizations in healthcare, financial services, manufacturing, transportation, government services, and other critical sectors.
The
This geographic spread demonstrates that Gunra is not simply a regional threat.
Its RaaS structure gives affiliates the opportunity to operate wherever vulnerable organizations can be found.
Brazil and South Korea Have Drawn Significant Attention
Earlier research from CloudSEK reportedly found that Brazil and South Korea were among the most heavily targeted regions, followed by Canada and Japan.
The geographical pattern is important because it reinforces the idea that RaaS operators are opportunistic.
They do not necessarily need to establish a physical presence in every country they attack.
A remote criminal affiliate can scan internet-facing infrastructure from almost anywhere.
RaaS Is Lowering the Barrier to Cybercrime
One of the most disturbing consequences of ransomware-as-a-service is accessibility.
A highly capable ransomware operation can package its tools into a platform that less-skilled affiliates can operate.
The affiliate may not know how to build ransomware.
They may not understand advanced cryptography.
They may not have the ability to develop an exploit.
But if the infrastructure provides them with ready-made tools and documentation, the attack can still become operational.
Cybercrime is increasingly adopting the logic of legitimate software businesses:
build once, distribute many times.
The Conti Legacy Did Not End With Conti
The connection to leaked Conti source code is another reminder that dismantling a cybercriminal organization does not necessarily erase its technological legacy.
Source code can survive.
Techniques can survive.
Infrastructure knowledge can survive.
Former affiliates can migrate to other groups.
Developers can reuse ideas.
The criminal ecosystem is remarkably resilient because its knowledge is transferable.
Taking down a single ransomware brand can therefore have limited long-term impact unless defenders also reduce the vulnerabilities that allow subsequent groups to succeed.
Deep Analysis: How a Gunra-Style Attack Chain Can Unfold
Step 1: Find an Internet-Facing Appliance
Attackers begin by identifying exposed VPN, firewall, remote-access, or security appliances.
Defenders should maintain an accurate inventory of all externally exposed infrastructure.
A basic external exposure review can begin with commands such as:
nmap -sV --open <authorized-network>
Only perform scanning against infrastructure you own or are explicitly authorized to test.
Step 2: Identify Vulnerable Software
Security teams can use authenticated vulnerability scanners and vendor advisories to determine whether exposed systems contain known exploited vulnerabilities.
For Linux-based administrative environments, basic package inspection can help identify outdated components:
uname -a
and:
sudo apt list --upgradable
For enterprise appliances, administrators should rely primarily on the vendor’s supported management and upgrade procedures.
Step 3: Verify Fortinet Exposure
Organizations using Fortinet products should verify the versions of FortiOS and FortiProxy deployed across their environment and compare them with Fortinet’s official security advisories.
The goal is not merely to determine whether a vulnerability exists.
The important question is whether an affected device is internet-facing, reachable, and actually exploitable under the organization’s configuration.
Step 4: Investigate Authentication Infrastructure
Because Gunra has demonstrated interest in authentication material, defenders should monitor unusual activity involving identity systems.
Useful indicators include:
Unexpected privileged logins
New administrator accounts
Unusual authentication failures
Authentication configuration changes
Unexpected OTP behavior
New authentication modules
Modified authentication files
Unusual session creation
Abnormal VPN sessions
These events should be correlated rather than investigated independently.
Step 5: Look for Suspicious PowerShell Activity
Windows ransomware campaigns frequently rely on PowerShell for discovery, credential access, persistence, and execution.
Security teams can search their SIEM for suspicious PowerShell activity.
For example:
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
Defenders should pay particular attention to encoded commands, unusual parent-child processes, execution from temporary directories, and PowerShell launched by unexpected applications.
Step 6: Monitor Credential Dumping
Credential theft should trigger immediate investigation.
Potential indicators include unexpected access to credential stores, LSASS interaction, abnormal security-tool execution, and unusual administrative behavior.
A simplified Windows event search can begin with:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625}
These events should be correlated with source IP addresses, devices, usernames, authentication methods, and timestamps.
Step 7: Protect Session Tokens
Organizations should monitor for abnormal session reuse.
Examples include:
One account appearing from distant locations
Impossible-travel authentication
Rapid changes in device identity
Unexpected session duration
New browser or device fingerprints
Repeated access using an old session
Modern identity platforms should use risk-based session controls and rapid token revocation when compromise is suspected.
Step 8: Protect Backup Infrastructure
Backup systems should use separate administrative credentials and should not depend entirely on the same identity infrastructure as production.
A basic backup validation process can include:
backup-job-status
followed by an actual restoration test.
The exact commands depend on the backup platform, but the principle remains universal:
A backup is not proven until restoration succeeds.
Step 9: Segment Critical Systems
Network segmentation can limit lateral movement after initial compromise.
Organizations should consider separating:
User networks
Server networks
Identity infrastructure
Backup infrastructure
Management networks
Production systems
Security infrastructure
Remote-access systems
The goal is to make every additional step expensive for the attacker.
Step 10: Treat VPN and Firewall Devices as Security-Critical Servers
A firewall is not simply another network appliance.
A VPN gateway can control access to the organization.
An identity portal can determine who is trusted.
A compromised security appliance can therefore become an attacker-controlled bridge into the environment.
These systems deserve the same urgency normally given to domain controllers and privileged identity infrastructure.
What Undercode Say:
- Old Vulnerabilities Can Still Create New Disasters
Gunra’s campaign demonstrates that vulnerability age is a poor measurement of danger.
2. Exploitation Is Often About Opportunity
Attackers do not need the newest exploit when thousands of systems remain vulnerable to old ones.
3. Perimeter Devices Have Become Strategic Targets
Firewalls and VPN appliances increasingly represent the first battlefield in ransomware attacks.
4. MFA Is Powerful but Not Magical
Multifactor authentication significantly improves security, but compromised sessions and authentication infrastructure can undermine it.
5. Session Theft Changes the Equation
Once an attacker possesses a valid authenticated session, the original MFA challenge may no longer protect the victim.
6. Identity Infrastructure Deserves Zero-Trust Treatment
Authentication systems should be considered crown-jewel infrastructure.
7. Attackers Want Reusable Secrets
Passwords, cookies, keys, tokens, and certificates can provide access far beyond the original compromised machine.
8. Ransomware Is Becoming More Modular
Gunra’s affiliate model shows how different actors can specialize in different stages of an attack.
9. Criminal Expertise Is Becoming a Product
Documentation and management panels allow less-skilled criminals to conduct operations that previously required specialized knowledge.
10.
Once advanced malware source code escapes, the defensive problem can continue for years.
11. Ransomware Operators Study Recovery Plans
Attackers increasingly understand that backups are their biggest obstacle.
12. Backup Deletion Is a Strategic Objective
Destroying recovery capability can dramatically increase pressure on victims.
13. Disaster Recovery Must Be Isolated
A recovery system connected to compromised administrative infrastructure may not survive the same attack.
14. Critical Infrastructure Has a Special Problem
Hospitals, transportation companies, manufacturers, and government services cannot always tolerate long outages.
15. Downtime Becomes a Weapon
The attacker does not necessarily need to destroy information permanently.
They only need to make the organization afraid of losing access to it.
- Data Theft Adds a Second Pressure Point
Double extortion means victims face both operational disruption and potential public disclosure.
17. Internet Exposure Should Be Minimized
If a management interface does not need to be public, it should not be public.
18. Patch Management Must Become Risk-Based
Known exploited vulnerabilities on internet-facing devices should receive exceptional priority.
19. KEV Listings Matter
CISA’s Known Exploited Vulnerabilities catalog provides an important signal about vulnerabilities being exploited in the real world.
20. Patching Alone Is Not Enough
Organizations also need detection, segmentation, credential protection, and recovery capabilities.
21. Authentication Logs Can Tell the Story
A successful ransomware investigation often depends on reconstructing unusual authentication activity.
22. Privileged Accounts Need Stronger Controls
Administrative credentials should have limited privileges, restricted access, and strong monitoring.
23. Security Appliances Need Monitoring Too
It is a mistake to assume that firewalls and VPNs are trustworthy simply because they are security products.
24. Vendor Appliances Can Become Attack Platforms
Once compromised, they can potentially provide attackers with visibility into legitimate traffic and authentication flows.
- Cookies Can Be More Valuable Than Passwords
A valid session may give an attacker immediate access without requiring the original password.
26. Identity Attacks Are Becoming More Important
The next generation of ransomware defense must focus heavily on identity security.
27. RaaS Changes the Threat-Actor Equation
Defenders are no longer dealing only with elite criminal organizations.
They may face affiliates with varying levels of expertise using professionalized infrastructure.
28. Geographic Borders Mean Less Online
Gunra’s reported victims across multiple continents demonstrate how quickly ransomware campaigns can cross national boundaries.
29. Critical Infrastructure Needs Layered Defense
No single control should be expected to stop a determined ransomware operation.
30. Zero Trust Becomes Practical, Not Theoretical
Every request should be evaluated based on identity, device, context, and risk rather than assumed trust.
31. Incident Response Must Start Before Encryption
Once ransomware begins encrypting systems, defenders may already be late.
- Credential Theft Can Be the Earlier Warning
Suspicious credential access may reveal an intrusion before ransomware deployment.
33. Backup Testing Should Be Routine
An organization should know exactly how long it takes to recover its most important systems.
34. Offline and Immutable Storage Matters
Backups that attackers cannot easily modify or delete provide a critical final layer of resilience.
35. Segmentation Limits the Blast Radius
Even when an attacker enters through a VPN, they should not automatically reach every important system.
36. Security Teams Need Cross-Domain Visibility
Network, endpoint, identity, cloud, and backup telemetry should be connected.
37. Ransomware Defense Is an Architecture Problem
Buying another security product cannot compensate for weak architecture.
- The Weakest Trusted System Can Become the Entry Point
The most sophisticated endpoint security solution is irrelevant if an exposed gateway provides attackers with privileged access.
- Gunra Is a Warning, Not an Isolated Incident
The same attack model can be adopted by other ransomware groups.
40. The Biggest Lesson Is Simple
Patch what is being exploited, protect identity infrastructure, isolate backups, and assume that attackers will eventually test every trusted boundary.
✅ Gunra Uses a Ransomware-as-a-Service Model
The advisory describes
✅ Fortinet Vulnerabilities Have Been Exploited
CVE-2024-55591 and CVE-2025-24472 were identified as vulnerabilities used by Gunra affiliates for initial access. Both are serious authentication-bypass weaknesses affecting Fortinet products.
✅ MFA Was Circumvented Through Session and Authentication Abuse
The reported incidents did not simply involve guessing or defeating an MFA code. Attackers obtained session information and, in one case, modified authentication processing to permit a designated OTP value.
✅ Backups Were Targeted
The advisory reported that Gunra affiliates deleted backup and archived data from both primary and disaster-recovery environments, demonstrating that recovery infrastructure itself can become a ransomware target.
❌ MFA Alone Cannot Be Treated as Complete Ransomware Protection
MFA remains an extremely important security control, but the Gunra incidents demonstrate why organizations must also protect sessions, authentication infrastructure, privileged accounts, VPN appliances, and identity systems.
Prediction
(+1) Ransomware Groups Will Continue Targeting VPNs and Firewalls
Internet-facing appliances will remain attractive because they provide attackers with a potentially powerful bridge between the public internet and internal networks.
(+1) Identity Attacks Will Become a Larger Part of Ransomware Operations
Expect more campaigns to focus on session cookies, authentication tokens, privileged accounts, identity providers, and access-control systems before deploying encryption.
(+1) Immutable Backups Will Become a Core Security Requirement
Organizations will increasingly treat offline and immutable backups as security controls rather than merely disaster-recovery tools.
(+1) RaaS Will Continue Lowering the Technical Barrier
As ransomware platforms become easier to operate, organizations may face more attacks from affiliates who lack advanced technical skills but have access to sophisticated criminal infrastructure.
(-1) Unpatched Internet-Facing Systems Will Remain a Major Weakness
Organizations that postpone patching known exploited vulnerabilities in VPNs and firewalls will continue to provide ransomware operators with relatively inexpensive opportunities for initial access.
(-1) MFA Alone Will Become Increasingly Insufficient
MFA will remain essential, but attackers are likely to focus more heavily on stealing valid sessions and compromising the infrastructure that processes authentication.
(+1) Identity-Centric Security Will Become the Next Major Defensive Priority
The Gunra campaign points toward a future where protecting identities, sessions, authentication systems, and privileged access may be just as important as protecting endpoints.
(+1) The Best Ransomware Defense Will Be Resilience
Organizations cannot guarantee that every intrusion will be prevented. The stronger strategy is to make compromise difficult, movement limited, credentials protected, recovery reliable, and extortion less effective.
The Final Warning: The Front Door Is Not Always the Weakest Point
Gunra’s campaign is a reminder that modern ransomware is no longer simply about malicious files appearing on computers.
The attack can begin with a firewall.
It can move through a VPN.
It can steal a session cookie.
It can manipulate authentication.
It can harvest reusable credentials.
It can destroy backups.
And only then does the ransomware appear.
That sequence changes how organizations should think about defense.
The question is no longer simply, “Can our antivirus detect ransomware?”
The more important question is:
“What happens if an attacker compromises one of the systems we trust to protect everything else?”
For Gunra affiliates, known vulnerabilities in Fortinet appliances appear to have provided precisely that opportunity.
And that is what makes this campaign so dangerous. The most sophisticated part of the attack may not be the ransomware at all.
It may be the attacker’s ability to turn the victim’s own trusted infrastructure into a weapon against them.
▶️ Related Video (62% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.darkreading.com
Extra Source Hub (Possible Sources for article):
https://www.pinterest.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
