[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPbP_AED-60myVSTboBJl6zRYhZmavrmokX8Xq3c2IQs":3,"$fxD_YC_6PAGkV5fE2Fmn5Icyn8epeEXKMWM0ShSrGPWU":70},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":67,"created_at":68,"updated_at":69,"published_at":46},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","Joint advisory AA26-222A details Gunra's Conti-derived encryptor, its double-extortion model and initial access through two FortiOS\u002FFortiProxy authentication bypasses (CVE-2024-55591, CVE-2025-24472).","On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.",[10,11,12,13,14,15],"CISA","Gunra","Ransomware","FortiOS","FortiProxy","CVE-2024-55591","# CISA Issues #StopRansomware Advisory for Gunra Ransomware\n\n*Joint advisory AA26-222A details Gunra's Conti-derived encryptor, its double-extortion model and initial access through two FortiOS\u002FFortiProxy authentication bypasses (CVE-2024-55591, CVE-2025-24472).*\n\n**Tags:** `CISA` `Gunra` `Ransomware` `FortiOS` `FortiProxy` `CVE-2024-55591`\n\n> On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS v3.1 (Fortinet) | CISA KEV | Affects |\n|---|---|---|---|\n| CVE-2024-55591 | 9.8 | ✅ added 14 Jan 2025 | FortiOS, FortiProxy |\n| CVE-2025-24472 | 8.1 | ✅ added 18 Mar 2025 | FortiOS, FortiProxy |\n\n## A joint #StopRansomware advisory for Gunra\n\nOn 10 August 2026 the FBI, CISA, the Department of Defense Cyber Crime Center (DC3), the NSA, the US Secret Service and the Republic of Korea's National Police Agency (KNPA) released joint advisory AA26-222A on the Gunra ransomware-as-a-service (RaaS) operation. It gives technical details, indicators of compromise and mitigation guidance.\n\nThe FBI first observed Gunra in April 2025. Its early campaigns focused on Windows, and reporting in mid-2025 indicated a Linux variant. As of January 2026 the operators run a formal RaaS affiliate programme on dark web forums, giving affiliates a management panel, a configurable builder and cross-platform lockers. The FBI has seen the group operate under the alias \"Golden Community\", and it recruits penetration testers to act as initial access brokers in exchange for a share of ransom profits.\n\n## How Gunra works: ChaCha20, RSA-4096 and double extortion\n\nThe advisory says Gunra appears to be based on, or heavily influenced by, the Conti source code leaked in 2022. The encryptor uses a multi-threaded design to encrypt files in parallel with ChaCha20 and RSA-4096, renames encrypted files with the `.ENCRT` extension (one July 2025 sample used `.CRYPT`) and writes a ransom note named `R3ADM3.txt` in each directory. Encryptors exist for Windows and Linux.\n\nGunra uses a double-extortion model. Affiliates collect business documents, databases, personal data and internal email before encryption. In at least one case the data was archived and exfiltrated to the Mega file-sharing service, with volumes of up to tens of terabytes. Victims are directed to a Tor-based negotiation portal or qTox and given five to seven days to make contact. If they do not pay, the group lists them on its leak site with a preview of the stolen files, and the advisory says the actors threaten to sell the data; the current leak site advertises datasets from specific victims for sale.\n\n## Initial access via two FortiOS\u002FFortiProxy authentication bypasses\n\nThe FBI observed Gunra actors gaining initial access mainly by exploiting known vulnerabilities in internet-facing devices, including firewalls and VPN appliances. The advisory names two FortiOS and FortiProxy authentication bypass flaws, both CWE-288:\n\n- **CVE-2024-55591**, rated CVSS 9.8 by Fortinet, which lets a remote unauthenticated attacker gain super-admin privileges through crafted requests to the Node.js websocket module.\n- **CVE-2025-24472**, rated CVSS 8.1 by Fortinet, a related authentication bypass in the same products.\n\nBoth are in CISA's Known Exploited Vulnerabilities catalogue. According to the advisory, exploitation abuses scheduled tasks on vulnerable FortiOS devices to create a persistent super user account named `forticloud-sync` with a hard-coded password.\n\nKNPA also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways, and in one case taking over an SSL-VPN administrator account that used default credentials.\n\n## Who is being targeted\n\nGunra affiliates target government, critical infrastructure and other organisations. Victims listed on the group's leak site span the Americas, Europe, the Middle East, Africa and the Asia-Pacific, across sectors including healthcare, financial services, critical manufacturing, transportation, government services, utilities, academia, media, retail and professional services.\n\n## Key points\n\n- AA26-222A was published on 10 August 2026 by the FBI, CISA, DC3, NSA, USSS and Korea's KNPA.\n- Gunra was first seen in April 2025, is likely derived from the leaked Conti code, and launched a formal RaaS programme in January 2026.\n- Encryption uses ChaCha20 with RSA-4096 and appends `.ENCRT`; encryptors exist for Windows and Linux.\n- Initial access includes CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472 (CVSS 8.1) in FortiOS\u002FFortiProxy, used to create a persistent `forticloud-sync` super user.\n- Victims who do not pay are listed on the leak site, where the group threatens to sell their data.\n\n## Further reading & sources\n\n- [#StopRansomware: Gunra Ransomware](https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa26-222a) (CISA)\n- [Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained](https:\u002F\u002Fwww.picussecurity.com\u002Fresource\u002Fblog\u002Fgunra-ransomware-multithreaded-chacha20-encryption-explained) (Picus Security)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5",{"cves":19,"iocs":35,"actors":41,"malware":48,"targets":50,"timeline":55,"industries":60,"technologies":64},[20,28],{"id":15,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2024-55591",9.8,0.9415,"Critical",89.88,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":27},"CVE-2025-24472","\u002Fvulnerabilities\u002FCVE-2025-24472",8.1,0.0724,"High",77.58,[36,39],{"type":37,"value":38},"other","forticloud-sync",{"type":37,"value":40},".ENCRT",[42],{"url":43,"name":11,"slug":44,"type":45,"origin":46,"motivation":47},"\u002Fthreat-groups\u002Fgunra","gunra","ransomware",null,"financial",[49],{"name":11},[51],{"name":52,"sector":53,"status":54,"geography":46},"Boeing","aerospace","confirmed",[56],{"date":57,"event":58,"description":59},"2025-04","First seen","Gunra first seen on Windows",[61],{"url":62,"name":63,"slug":53},"\u002Findustries\u002Faerospace","Aerospace",[65],{"vendor":66,"product":13},"Fortinet","ransomware_incident","2026-08-27T17:06:47.703652+00:00","2026-10-16T12:29:14.248116+00:00",{"articles":71},[72,82,93,104],{"slug":73,"title":74,"summary":75,"tags":76,"hero_image_url":79,"story_type":80,"created_at":81},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[11,77,78,13,14,12],"AhnLab ASEC","Operation Double Barrel","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","threat_actor_activity","2026-09-18T07:15:06.272711+00:00",{"slug":83,"title":84,"summary":85,"tags":86,"hero_image_url":91,"story_type":67,"created_at":92},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[87,88,89,12,90],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":94,"title":95,"summary":96,"tags":97,"hero_image_url":102,"story_type":67,"created_at":103},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[98,12,99,100,101],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":105,"title":106,"summary":107,"tags":108,"hero_image_url":113,"story_type":67,"created_at":114},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day","In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.",[109,110,111,12,112],"Interlock","Cisco FMC","CVE-2026-20131","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00"]