Vulnerability details
| CVE | CVSS v3.1 (Fortinet) | CISA KEV | Affects |
|---|---|---|---|
| CVE-2024-55591 | 9.8 | ✅ added 14 Jan 2025 | FortiOS, FortiProxy |
| CVE-2025-24472 | 8.1 | ✅ added 18 Mar 2025 | FortiOS, FortiProxy |
A joint #StopRansomware advisory for Gunra
On 10 August 2026 the FBI, CISA, the Department of Defense Cyber Crime Center (DC3), the NSA, the US Secret Service and the Republic of Korea's National Police Agency (KNPA) released joint advisory AA26-222A on the Gunra ransomware-as-a-service (RaaS) operation. It gives technical details, indicators of compromise and mitigation guidance.
The FBI first observed Gunra in April 2025. Its early campaigns focused on Windows, and reporting in mid-2025 indicated a Linux variant. As of January 2026 the operators run a formal RaaS affiliate programme on dark web forums, giving affiliates a management panel, a configurable builder and cross-platform lockers. The FBI has seen the group operate under the alias "Golden Community", and it recruits penetration testers to act as initial access brokers in exchange for a share of ransom profits.
How Gunra works: ChaCha20, RSA-4096 and double extortion
The advisory says Gunra appears to be based on, or heavily influenced by, the Conti source code leaked in 2022. The encryptor uses a multi-threaded design to encrypt files in parallel with ChaCha20 and RSA-4096, renames encrypted files with the .ENCRT extension (one July 2025 sample used .CRYPT) and writes a ransom note named R3ADM3.txt in each directory. Encryptors exist for Windows and Linux.
Gunra uses a double-extortion model. Affiliates collect business documents, databases, personal data and internal email before encryption. In at least one case the data was archived and exfiltrated to the Mega file-sharing service, with volumes of up to tens of terabytes. Victims are directed to a Tor-based negotiation portal or qTox and given five to seven days to make contact. If they do not pay, the group lists them on its leak site with a preview of the stolen files, and the advisory says the actors threaten to sell the data; the current leak site advertises datasets from specific victims for sale.
Initial access via two FortiOS/FortiProxy authentication bypasses
The FBI observed Gunra actors gaining initial access mainly by exploiting known vulnerabilities in internet-facing devices, including firewalls and VPN appliances. The advisory names two FortiOS and FortiProxy authentication bypass flaws, both CWE-288:
- CVE-2024-55591, rated CVSS 9.8 by Fortinet, which lets a remote unauthenticated attacker gain super-admin privileges through crafted requests to the Node.js websocket module.
- CVE-2025-24472, rated CVSS 8.1 by Fortinet, a related authentication bypass in the same products.
Both are in CISA's Known Exploited Vulnerabilities catalogue. According to the advisory, exploitation abuses scheduled tasks on vulnerable FortiOS devices to create a persistent super user account named forticloud-sync with a hard-coded password.
KNPA also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways, and in one case taking over an SSL-VPN administrator account that used default credentials.
Who is being targeted
Gunra affiliates target government, critical infrastructure and other organisations. Victims listed on the group's leak site span the Americas, Europe, the Middle East, Africa and the Asia-Pacific, across sectors including healthcare, financial services, critical manufacturing, transportation, government services, utilities, academia, media, retail and professional services.
Key points
- AA26-222A was published on 10 August 2026 by the FBI, CISA, DC3, NSA, USSS and Korea's KNPA.
- Gunra was first seen in April 2025, is likely derived from the leaked Conti code, and launched a formal RaaS programme in January 2026.
- Encryption uses ChaCha20 with RSA-4096 and appends
.ENCRT; encryptors exist for Windows and Linux. - Initial access includes CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472 (CVSS 8.1) in FortiOS/FortiProxy, used to create a persistent
forticloud-syncsuper user. - Victims who do not pay are listed on the leak site, where the group threatens to sell their data.
Further reading & sources
- #StopRansomware: Gunra Ransomware (CISA)
- Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained (Picus Security)