Gunra ransomware actors are exploiting two Fortinet vulnerabilities to target government and critical national infrastructure organizations, a joint advisory issued by US and Republic of Korea authorities has warned.

Gunra is a ransomware-as-a-service (RaaS) which primarily exploits known vulnerabilities in internet-facing devices, including firewalls and VPN appliances, to gain initial access.

Once in a network, affiliates conduct highly advanced persistence and lateral movement techniques, ultimately allowing for the stealthy exfiltration of large volumes of data from Microsoft 365 services.

The advisory is authored by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and other US government agencies alongside the Republic of Korea’s National Police Agency (KNPA),

Gunra ransomware is based on leaked Conti ransomware source code in 2022, and was first observed in April 2025. In early 2026, the group developed a structured RaaS affiliate program advertised on dark web forums. It has also adopted new branding aliases, including operating under the name “Golden Community.”

Legacy Fortinet Vulnerabilities Still Effective

The FBI has observed Gunra specifically targeting two legacy Fortinet vulnerabilities.

These are both authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions:

• CVE-2024-55591 is a critical flaw which allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module
• CVE-2025-24472 is a high severity vulnerability which can allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests

Patches are available for both flaws.

The advisory, published on August 10, also highlighted Gunra actors’ ability to establish persistence and achieve lateral movement in victim environments following initial access, largely using techniques to bypass authentication protocols.

In one observed case, Gunra actors gained access to an administrator account for a secure socket layer (SSL)-VPN appliance by exploiting default credentials when account lockout controls were not present.

They subsequently established connections between the compromised systems and an external attacker-controlled server by downloading the SSH tunnelling tool OpenSSH.

In another example cited, the attackers enabled the continuous bypass of multi-factor authentication (MFA) by modifying authentication processing files on the corporate VDI authentication portal server.

Commenting on the advisory, Jacob Krell, senior director, secure AI solutions and cybersecurity at Suzu Labs, noted that both vulnerabilities have been exploited by multiple ransomware groups, with victims often still able to be targeted even after applying fixes.

“Patching fixes the entry point. It does nothing about an authentication backdoor already embedded in the MFA flow. I've seen organizations close the vulnerability and declare themselves clean while the attacker's persistence mechanism sat untouched in the auth stack,” he commented.

Attackers Use Stealth to Exfiltrate Vast Volumes of Data

Gunra actors are also adept at stealthy lateral movement and exfiltrating large volumes of data from victim environments before defenders are aware of their presence.

This is designed to ensure an effective double-extortion strategy – forcing victims to pay both to have their files decrypted and for the exfiltrated data not to be published online.

The advisory said that Gunra employs multiple stealth and defense impairment techniques to hinder detection and analysis while moving across networks using stolen credentials and authentication bypass techniques.

This includes deleting system and network access logs and clearing command history.

Notably, the group primarily conducts malicious activities and internal infrastructure reconnaissance between the hours of 10.00pm and 6.00am in the victim’s time zone, while administrators are typically offline.

Roman Sannikov, global research coordinator at iCOUNTER, said that security teams should take particular note of Gunra’s “out of hours” activities.

“If your detection coverage drops off overnight, that's exactly the gap this group, now also operating under the alias Golden Community, is built to exploit,” he said.

The ransomware binary used by the group includes extensive filtering rules to focus only on files that are consistent with user data. This is to avoid dedicating encryption resources to non-critical files and streamline the collection of user-specific data, according to the advisory.

The FBI has observed Gunra actors use a malicious executable to exfiltrate victim data from Microsoft OneDrive and SharePoint. In at least one case, the actors successfully exfiltrated up to tens of terabytes of data by generating compressed archives with sensitive data and exfiltrating the archives to the file-sharing service Mega.

Gunra Ransom Demands in the 10s of Millions

The group’s ransom notes generally start negotiations by demanding tens of millions of dollars, which the report described as “arbitrarily high.”

Victims are typically given five to seven days to begin negotiations via a Tor-based negotiation portal. In some cases, the group has even attempted to communicate directly with management staff at victim organizations via email.

Threats of data leaked being on Gunra’s data leak site are made if the victims fail to engage in negotiations or make a payment.

Victims have spanned regions throughout the world, and multiple critical sectors, including healthcare, financial services, government organizations and critical manufacturing.

Defending Against the Gunra Threat

The advisory urged organizations to focus on three key areas to counter the tactics employed by Gunra. These are:

• Prioritizing patching known exploited vulnerabilities in internet-facing systems, including virtual private network (VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure
• Implementing and testing offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without ransom payment
• Segmenting networks to restrict lateral movement from an initially compromised device to other systems in the organization