Gunra Isn't Using a Zero-Day. It's Using the Fortinet Bug You Didn't Patch.

Five federal and allied agencies don't put their names on a joint advisory for a quiet Tuesday. On August 10, 2026, CISA, the FBI, the NSA, the U.S. Secret Service, and partners in South Korea did exactly that, and the name on the advisory was Gunra. If you run an internet-facing Fortinet appliance, the rest of this is about you specifically.

Here's the part that should land hardest. The way in isn't a zero-day nobody could have seen coming. It's two Fortinet authentication-bypass bugs, CVE-2024-55591 and CVE-2025-24472, in FortiOS and FortiProxy. Both have patches. Both have had patches. If yours aren't applied, you are not "at elevated risk." You are the exact target profile the advisory describes, and the only thing standing between Gunra and your domain is a maintenance window you keep sliding to next month.

Gunra is competent, patient, and boring, and that's what makes it dangerous

Trend Micro first spotted Gunra in April 2025. It didn't spring from nowhere. It was built on the leaked Conti source code, which means most of the tradecraft is battle-tested and already familiar to anyone who lived through the last five years of ransomware. By January 2026 the operators had turned it into a business: a formal ransomware-as-a-service program with an affiliate panel, a configurable builder, lockers for both Windows and Linux, and open recruitment of access brokers and pen-testers willing to work for a cut. They've also operated under the name "Golden Community."

The model is double extortion, and there's nothing clever about it. Steal the data first. Encrypt the estate second. Then charge you twice, once for a decryptor and once for a promise not to publish. Victims get somewhere between five and seven days before the stolen files land on a Tor leak site. The FBI notes that Gunra actors have emailed victim leadership directly to turn up the pressure, with limited success so far.

The targets are the ones that can least afford a week of downtime: healthcare and public health, financial services, government, professional services, and nonprofits. Confirmed activity spans Turkey, Taiwan, the United States, and South Korea, and the leak site adds claims in Brazil, Japan, and Canada.

The attack is a chain, and every link is one you can watch

Once an affiliate is through the Fortinet front door, the playbook is depressingly repeatable. They manipulate accounts, bypass multi-factor authentication, and settle in through the SSL-VPN so they can come back whenever they want. They escalate on default and domain-admin credentials, dump NTDS straight off the domain controller with secretsdump.py, sniff VDI credentials off the wire, hijack session cookies, and lift a symmetric encryption key sitting unprotected on a server.

Then they move. RDP and SMB, Impacket's psexec and smbclient, pass-the-hash and pass-the-ticket, all with credentials they already stole. They keep the noise down on purpose: they work late nights and early mornings, they check for debuggers, and they wipe command history behind them. When it's time to take something, they go after business documents, databases, PII, and email, including cloud data pulled out of OneDrive and SharePoint by a malicious main.exe. They compress the haul with 7-Zip and WinRAR, push it out to Mega over the web and to their own FTP through FileZilla, and tunnel the whole thing over SSH.

The finale is the loud part. ChaCha20 plus RSA-4096 encryption, a .ENCRT extension on every file, a ransom note named R3ADM3.txt, and deleted backups and volume shadow copies across every data center they can reach, so restoring cleanly isn't an option you have left.

None of that is invisible. Every step throws a signal. The problem is never that the signal wasn't there. It's that nobody was watching for it.

The tradecraft, mapped to ATT&CK

If your detection team wants the spine of this in one place, here's the behavior mapped to MITRE ATT&CK. Hunt the behaviors, not the file hashes, because the hashes change overnight and the behaviors don't. Initial access is Exploit Public-Facing Application (T1190) against the two Fortinet CVEs. Execution runs through WMI (T1047) to delete shadow copies, Native API (T1106), and the Windows command shell (T1059.003). Persistence comes from account manipulation (T1098) and external remote services via SSL-VPN (T1133). Privilege escalation leans on default accounts (T1078.001) and domain accounts (T1078.002).

Credential access covers NTDS dumping via secretsdump.py (T1003.003), network sniffing (T1040), session cookie theft (T1539), password stores (T1555), and MFA bypass (T1556.006). Defense evasion includes debugger evasion (T1622), clearing command history (T1070.003), off-hours execution, and selective directory and extension exclusion. Discovery spans file and directory enumeration across drives A to Z (T1083) and system network connections (T1049). Lateral movement uses RDP (T1021.001), SMB via Impacket (T1021.002), pass-the-hash (T1550.002), and pass-the-ticket (T1550.003).

Collection pulls email (T1114), local system data (T1005), cloud storage from OneDrive and SharePoint (T1530), and archives with 7-Zip and WinRAR (T1560). Command and control uses OpenSSH ingress tool transfer (T1105) and SSH protocol tunneling (T1572). Exfiltration goes to Mega over web service (T1567) and FileZilla FTP over an alternative protocol (T1048). Impact is data encrypted for impact (T1486), inhibited system recovery (T1490), and financial theft (T1657).

Tooling seen in the wild: FileZilla, Amass, RClone, Sliver, 7-Zip, WinRAR, DBeaver, MobaXterm, AnyDesk, Mimikatz, and the Impacket suite.

The indicators, if you're going hunting

Treat these as a floor, not a finish line. The addresses below use defanged notation so nothing here is clickable by accident. The complete indicator set, including the full IP range and the qTox negotiation IDs, lives in the advisory itself.

Let me argue against my own headline for a paragraph

None of this means patching one firewall makes you safe, and I don't want to sell that. Gunra's affiliates are opportunists with a business model, and the two Fortinet bugs are just the cheapest way in this quarter. The next campaign will use a different entry point, and a company that only ever closes the door named in the last advisory is always defending against the previous war. The real lesson isn't "patch these two CVEs," though you absolutely should. It's that a competent crew got all the way to your backups using stolen credentials and legitimate tools, and almost none of it required an exploit after the first ten minutes. That should tell you where your gaps actually are, and they're probably not on your perimeter.

What I would do about it

Patch the two Fortinet bugs today, not next window. Every internet-facing FortiOS and FortiProxy appliance, CVE-2024-55591 and CVE-2025-24472, closed now. This is the one item on the list with a deadline that already passed.

Treat MFA you can silently change as MFA you don't have. Gunra modifies the authentication process to accept its own values. Enforce strong MFA everywhere, especially on VPN and RDP, and monitor for changes to the auth configuration itself, because that's the tell.

Keep backups the ransomware can't reach. Offline and immutable, in a segmented location, tested. The entire endgame of this attack is making sure you can't restore, so the backup you can restore from is the one that decides whether you pay.

Segment so the edge isn't the domain. A foothold on an internet-facing appliance should not be a straight line to your domain controllers. Audit privileged and default accounts, enforce least privilege, and review your DCs for accounts you didn't create.

Hunt the behaviors, not the hashes. Off-hours logons, secretsdump against a domain controller, archives staged for Mega or FileZilla, shadow copies deleted by WMI. Those signals were present in every case in this advisory. Someone just had to be looking.

And vet whoever defends this for you the way I keep telling you to buy an MSSP: skeptically, in writing, with one question on the table. How would you have caught this one? "We patch" is a floor anyone can claim. Evidence that these Fortinet bugs were closed the day they were disclosed is the difference between a provider who serves you and one who bills you.

If that question makes you uneasy about your own coverage, don't sit on it. Contact CyberShell today for your cybersecurity concerns: cybershell.ca.

Sources

CISA, FBI, NSA, U.S. Secret Service, and South Korean partners, joint #StopRansomware advisory Gunra Ransomware (AA26-222a), August 10, 2026, for the tradecraft, ATT&CK mappings, and indicators of compromise · Trend Micro, first observation of Gunra, April 2025 · Reporting from The Register, BleepingComputer, The Record, and IT Pro, August 2026. The full IP range and qTox IDs are in the advisory itself. Reporting current as of August 2026.

• •Ransom note: R3ADM3.txt
• •Encrypted extensions: .ENCRT (primary); .CRYPT (documented July 2025)
• •SHA-256: main.exe 2dc70a12…e2751 and 834efe9b…e5e1; cryptor.exe 91f8fc7a…ae53b0; msmp.exe a82e496b…3689d9
• •Leak sites (Tor): gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad[.]onion; lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd[.]onion; clearnet mirror datapub[.]news (Jun–Jul 2025)
• •IPs: 23.239.119[.]2–6, 86.54.28[.]216, 103.125.234[.]14, 70.36.99[.]82 (full set in AA26-222a)
• •Contact: a00f105546345756@proton[.]me, ilovemycubscout@gmail[.]com, plus qTox IDs

Gunra will not be the last crew to walk through an unpatched edge appliance. The organizations that come through this one intact are the ones that closed the front door on disclosure day and built the estate so a single foothold isn't a whole-network event.