In today's digital landscape, the threat of ransomware attacks looms large, especially when it comes to critical infrastructure. The Gunra ransomware, a sophisticated and evolving threat, has been exploiting vulnerabilities in Fortinet systems to target government and national infrastructure organizations. This article delves into the tactics employed by Gunra, the implications of its activities, and the steps organizations can take to defend themselves.
The Rise of Gunra Ransomware
Gunra, a ransomware-as-a-service (RaaS) operation, has been making waves since its emergence in 2025. What sets Gunra apart is its focus on exploiting known vulnerabilities in internet-facing devices, such as firewalls and VPN appliances, to gain initial access. Once inside a network, its affiliates employ advanced persistence and lateral movement techniques, allowing them to stealthily exfiltrate vast amounts of data from Microsoft 365 services.
Exploiting Fortinet Flaws
A joint advisory issued by US and Republic of Korea authorities highlights Gunra's specific targeting of two legacy Fortinet vulnerabilities. These vulnerabilities, CVE-2024-55591 and CVE-2025-24472, are critical and high-severity flaws, respectively, that allow remote attackers to gain super-admin privileges. Despite patches being available, Gunra actors have been observed exploiting these vulnerabilities, demonstrating the importance of timely patching and the potential for attackers to exploit legacy issues.
Stealthy Lateral Movement and Exfiltration
Gunra actors are skilled at moving laterally within victim environments, employing techniques to bypass authentication protocols. They establish connections to external servers, download tools like OpenSSH, and modify authentication processing files to maintain persistence. This stealthy approach allows them to exfiltrate large volumes of data before defenders can detect their presence. By focusing on user-specific data, Gunra ensures an effective double-extortion strategy, demanding high ransom payments and threatening to leak exfiltrated data.
Impact and Implications
The impact of Gunra's activities is significant, with victims spanning regions and critical sectors, including healthcare, finance, and government. The group's ransom demands start in the tens of millions of dollars, and their tactics include direct communication with management staff and threats of data leaks. This raises concerns about the potential disruption to critical services and the financial and reputational damage that can result.
Defending Against Gunra
To counter Gunra's tactics, organizations are advised to focus on three key areas: prioritizing the patching of known exploited vulnerabilities, implementing offline, immutable backups stored in physically separate locations, and segmenting networks to restrict lateral movement. These measures aim to address the vulnerabilities exploited by Gunra and mitigate the impact of potential breaches.
Conclusion
The Gunra ransomware serves as a stark reminder of the evolving nature of cyber threats and the importance of proactive cybersecurity measures. By understanding the tactics employed by threat actors like Gunra, organizations can better prepare and defend against these sophisticated attacks. As the digital landscape continues to evolve, staying vigilant and adapting security strategies will be crucial in safeguarding critical infrastructure and sensitive data.
