Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption

Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption 1. Basic Information - Severity: Critical - Title: #StopRansomware: Gunra Ransomware (AA26-222A) - Publishers: CISA / FBI / DC3 / NSA / USSS / Korean National Police Agency (KNPA) - Publication Date: 2026-08-10 - Original Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a - Primary PDF: https://media.defense.gov/2026/Aug/10/2003976697/-1/-1/0/CSA_STOPRANSOMWARE_GUNRA_RANSOMWARE.PDF - Related Sources: - NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ - Related Malware, Groups, CVEs, and Products: Gunra, Golden Community, Conti variant, CVE-2024-55591, CVE-2025-24472, FortiOS, FortiProxy, SSL-VPN, VDI, Active Directory, Hiware, OneDrive, SharePoint, Mega, Sliver, Impacket, RClone 2. Executive Summary This is a double-extortion Ransomware-as-a-Service (RaaS) that enters networks through FortiGate/VPN authentication bypasses or default credentials. It modifies VPN traffic to steal sessions, implants static OTP backdoors into VDI authentication processes, steals dozens of terabytes of data from Active Directory, management servers, and SaaS platforms, and finally encrypts Windows and Linux systems. 3. Attack Flow Chain A: Fortinet-Initiated (Observed by FBI) - Exploits CVE-2024-55591 orCVE-2025-24472 on internet-facing FortiOS/FortiProxy to bypass authentication. - Gains access to the firewall/SSL-VPN and performs internal reconnaissance. - Performs SMB lateral movement using Impacket's psexec.py orsmbclient.py . - Executes secretsdump.py on the domain controller to retrieve password hashes derived fromNTDS.dit . - Moves to privileged system accounts using pass-the-hash/pass-the-ticket techniques. - Collects, compresses, and exfiltrates data using main.exe (for OneDrive/SharePoint), RClone, 7-Zip, WinRAR, and FileZilla. - Deletes Volume Shadow Copies via WMI/WMIC and destroys both primary and Disaster Recovery (DR) backups. - Deploys the Gunra encryptor to encrypt target files using ChaCha20 + RSA-4096, appending .ENCRT or.CRYPT . - Demands payment within 5 to 7 days using R3ADM3.txt , a Tor negotiation portal, and qTox. Chain B: VPN and VDI Authentication Compromise (Observed by KNPA) - Exploits credential exposure or SSH access control vulnerabilities on internet-facing VPN gateways, or uses default credentials without lockout mechanisms. - Reaches the SSL-VPN administrator account, downloads OpenSSH from an external server, and builds a tunnel. - Accesses the SSL-VPN management console from an internet-connected network administrator workstation. - Identifies an unused account that can reach both the internet and internal networks, and modifies settings to bypass mandatory password changes. - Modifies the VPN traffic control functions to collect credentials and session information sent to the VDI portal. - Hijacks VDI sessions using stolen session cookies, and performs RDP lateral movement to VDI authentication servers, AD servers, and IT staff virtual desktops. - Modifies the VDI authentication processing file to create an MFA bypass where a specific attacker-defined OTP always succeeds. - Connects via SSH from the compromised VDI to the Hiware access control server and steals symmetric keys. - Uses the keys to decrypt enterprise server passwords in the database, obtaining credentials for all servers. - Gathers network architecture documents from the IT staff VDI and distributes ransomware to database servers and NAS devices. Chain C: Collection, Encryption, and Extortion - Filters documents, databases, PII, internal emails, and network diagrams. - Collects local data using main.exe for OneDrive/SharePoint and archive tools for local files. - Exfiltrates data to Mega, FTP, or RClone. Observed cases reached dozens of terabytes. - Enumerates A-Z drives, excludes system-critical paths and extensions, and adds user data to a work queue. - Encrypts files using multi-threading and deletes shadow copies and backups. - Previews OneDrive/SharePoint directory listings on a leak site, threatening to sell or publish data if payment is not made. 4. Attacker Positions and Execution Locations - External Attacker / Affiliate: Enters through internet-facing management interfaces such as FortiGate, VPN, RDP, and SSH. - Perimeter Devices: Used for exploits, credential/session capture, OpenSSH tunneling, and account modification. - Admin Workstations & VDIs: Act as pivot points for SSL-VPN management, cookie hijacking, RDP pivoting, and gathering network diagrams. - AD & Access Control Servers: Locations for acquiring NTDS.dit hashes and server password decryption keys. - SaaS & Cloud: OneDrive/SharePoint are targets for collection via main.exe , while Mega and others serve as exfiltration destinations. - Servers, NAS, & Backups: The final targets for ransomware execution and recovery disruption. - Tor & qTox: Communication channels for negotiation, extortion, and leak sales. 5. Perspectives of Users and Administrators Users - VPN/VDI logins appear normal because valid cookies or specified OTPs are used. - Nighttime RDP sessions appear on IT staff virtual desktops. - File extensions change to .ENCRT /.CRYPT , andR3ADM3.txt appears in the final stage. Administrators & SOCs - FortiGate authentication bypasses, default account attempts, and continuous logins without account lockout. - Password-change policy changes on unused VPN accounts. - VPN traffic-control settings and unexpected modifications to VDI authentication files. - Chained access from admin workstations to VPN consoles, VDIs, AD, and Hiware. - Execution of secretsdump.py ,psexec.py ,smbclient.py , Mimikatz, Sliver, RClone, 7-Zip, and FileZilla. - Internal reconnaissance between 22:00 and 06:00, along with the deletion of command history and system/network logs. - Mass enumeration/downloads from OneDrive/SharePoint, and large data transfers to Mega or similar services. - Deletion of shadow copies via WMI and destructive operations on both primary and DR backups. - The encryptor itself generates no DNS or HTTP traffic, making endpoint behavior critical. 6. Success and Failure Conditions for Attackers Success Conditions - Unpatched FortiOS/FortiProxy and VPN/SSH access-control vulnerabilities are exposed to the internet. - Default credentials, missing account lockouts, and unused accounts remain active. - Admin workstations can reach perimeter device management consoles and internal critical systems. - Integrity monitoring for VPN configurations, VDI authentication files, and OTP processing is absent. - SMB/RDP/SSH to the Domain Controller (DC) is widely permitted, and Impacket cannot be blocked. - Access-control database encryption keys and databases reside within the same trust boundary. - Mass SaaS downloads and outbound egress are permitted. - Backups are online and accessible from production credentials/networks. Failure Conditions - CVE-2024-55591 andCVE-2025-24472 are patched, and internet-facing management interfaces are restricted. - Default/unused accounts are removed, and lockouts with phishing-resistant MFA are enforced. - VPN configs, VDI authentication files, and OTP processes are signed and monitored. - Admin workstations are tiered, separating perimeter management from AD management. - SMB/RDP, service creation, and NTDS access to the DC are minimized and detected. - SaaS downloads and outbound traffic are controlled by volume, device, and time. - Immutable/offline backups are maintained with separate credentials and networks, and regular restore tests are conducted. 7. What Happens Upon Attack Success - VPN/VDI sessions and static OTP backdoors may persist even after password resets. - Domain hashes, enterprise server passwords, and network diagrams are handed over to the attacker. - Dozens of terabytes of OneDrive/SharePoint data, local files, emails, and PII can be stolen. - Database servers, NAS devices, and Windows/Linux endpoints are encrypted. - Shadow copies, primary backups, and DR backups are deleted, extending recovery times. - High payments are demanded via leak sites, emails to management, and Tor/qTox. 8. Observable Logs - Collection and export of internal emails. - Direct ransom solicitation emails sent to executives. - Contacts from Gunra-related negotiation addresses. Proxy / SWG / DNS - OpenSSH or tool downloads from attacker-controlled servers. - Large uploads to Mega, FTP, or RClone cloud storage. - Tor negotiation, leak site, and qTox-related traffic. - Sliver C2 and known IOC communications. - The standalone encryptor generates no DNS or HTTP traffic. Endpoint / EDR - Impacket tools: psexec.py ,smbclient.py ,secretsdump.py . - Remote service creation, SMB admin shares, RDP, and OpenSSH tunnels. - Access to OneDrive/SharePoint via main.exe . - Abnormal use of 7-Zip, WinRAR, RClone, FileZilla, Mimikatz, Sliver, and AnyDesk. - wmic shadowcopy ... delete , A-Z drive enumeration, and multi-thread encryption. - Files named .ENCRT /.CRYPT andR3ADM3.txt . - Deletion of command history, event/network logs, and use of IsDebuggerPresent . Identity / IdP - Successful logins and policy changes on VPN default/unused accounts. - VDI sessions using stolen cookies, missing MFA challenges, or repeated success with identical OTP values. - Nighttime admin logins and RDP to multiple IT VDIs. - Pass-the-hash/pass-the-ticket and abnormal service account usage. - Rapid utilization of numerous server credentials from Hiware. SaaS / Cloud - Mass listing/downloads of OneDrive/SharePoint files by non-standard clients like main.exe . - Sudden surges in download volumes per account, followed immediately by outbound transfers after archiving. - Upload