Gunra Ransomware Exploits Fortinet CVE-2024-55591 to Hit 51 Critical Infrastructure Orgs

Gunra actors exploit two related authentication bypass vulnerabilities in Fortinet edge devices. CVE-2024-55591 is a CWE-288 flaw in FortiOS that allows a remote unauthenticated attacker to gain super-admin privileges by sending crafted requests to the Node.js websocket module on the management interface. CVE-2025-24472 is a parallel flaw in FortiProxy that accepts crafted CSF proxy requests to achieve the same outcome. Neither vulnerability requires credentials, an existing session, or user interaction.

After obtaining super-admin access, Gunra affiliates create administrative accounts to maintain persistent access even after the initial vulnerability is patched. They then pivot from the Fortinet appliance into the internal network, targeting VPN-connected segments and Active Directory environments. The lateral movement phase uses Impacket's psexec.py, smbclient.py, and secretsdump.py tools to spread across Windows hosts and dump credentials from domain controllers. The CISA advisory documents confirmed session hijacking through SSL-VPN manipulation and MFA bypass via OTP tampering.

On Linux-based infrastructure, Gunra deploys a separate locker payload. Breakglass Intelligence disclosed in March 2026 that this Linux variant contains a fatal cryptographic weakness: the random number generator uses a weak seed producing only approximately 256 possible values per second during encryption. Key recovery without payment is possible for Linux victims. Windows variants use standard Salsa20 or ChaCha20 encryption with no known weakness. The Fortinet VPN credential exposure documented in the 73,000-firewall incident shows that FortiGate management interfaces have been a persistent target for years, and unpatched appliances represent the most direct path into enterprise networks available to threat actors today.

Gunra has claimed 51 confirmed victims since April 2025 across healthcare, government, financial services, manufacturing, and critical infrastructure. CISA advisory AA26-222A documents active targeting in the Americas, Europe, Middle East, Africa, and Asia-Pacific simultaneously. The August 11 incident at a Polish combined heat and power plant represents a significant escalation: the attack took the steam turbine and process-water treatment system offline, disrupting heat and hot water supply to 50,000 residential customers. Confirmed targeting of Schneider Electric PowerLogic P5 protection relay systems in that attack indicates Gunra affiliates are actively pursuing operational technology as a pressure lever in extortion negotiations.

Prior victim sectors include hospitals and health systems, where an encrypted electronic health record system or patient monitoring network creates immediate clinical risk that organizations may treat as grounds for faster payment. Government agencies face the additional pressure of public service disruption. Financial institutions face regulatory notification deadlines that compress the window before mandatory disclosure.

Gunra's RaaS affiliate program, launched in January 2026 under the alias Golden Community, dramatically expanded the group's targeting capacity by recruiting initial access brokers and penetration testers on dark web forums. Affiliates receive a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured operational documentation covering network reconnaissance, lateral movement, and extortion negotiation. AhnLab confirmed in mid-2026 that tool overlaps with Lazarus Group campaigns suggest the North Korean state-linked APT provided shared infrastructure or specialized tooling to Gunra operators, bringing nation-state TTPs into a financially motivated ransomware operation.

Gunra ransomware is built directly from the Conti v2 source code leaked in February 2022. The group retains Conti's core encryption engine and operational security model while adding Linux cross-platform capability and a modernized RaaS affiliate structure. The shadow copy deletion sequence, WMI command execution patterns, and database dumping via SQLCmd that appear in Gunra intrusions are directly traceable to published Conti playbooks, which is why three of the Sigma rules in this post detect Conti-lineage commands and still fire on Gunra activity.

Gunra's double-extortion model applies maximum pressure through a specific timeline: affiliates exfiltrate data before deploying the encryptor, then present victims with a five-to-seven-day countdown before publishing stolen data on the leak site. The group also conducts direct email communication with management staff, bypassing IT teams and applying pressure at the board level. This social engineering overlay on top of technical encryption is a tactic the BlackFile ransomware gang used extensively against retail and hospitality targets in 2025 and 2026.

The CISA advisory attributes some initial access to compromised VPN credentials sourced from infostealer logs and dark web credential brokers, in addition to direct Fortinet CVE exploitation. This means organizations with unpatched Fortinet appliances face two simultaneous attack paths: zero-day exploitation by affiliates who access the management interface directly, and credential-stuffing by affiliates who purchase VPN credentials harvested by infostealers from endpoints in the same environment. Patching the CVE eliminates the direct exploitation path but does not address credential exposure from endpoints.

Three rules target Conti-lineage commands and WMI abuse patterns from Gunra's leaked codebase.

• Log sources: Windows Security event logs, process creation telemetry
• WMI rules: Require Sysmon EventID 1 or Windows Security EventID 4688 with full command line logging enabled

CISA advisory AA26-222A includes downloadable STIX XML and STIX JSON IOC packages. The file-based indicators below are drawn from that advisory and independent Gunra malware analysis. Add hashes to your EDR deny list immediately. Hunt for the ransom note filename and file extension across all Windows endpoints and SMB shares using your EDR's file search capability.

The process name gunraransome.exe appears in early Gunra variants. Create a process name block rule in your EDR or endpoint application control policy and alert on any process creation matching this string, including variations with different casing. The encrypted file extension .ENCRT does not appear in any legitimate application; a file extension alert rule in your DLP or EDR will identify an active encryption event before full network-wide encryption completes.

For network detection, Gunra's negotiation infrastructure operates exclusively over Tor. Block all outbound Tor traffic at the perimeter firewall using destination port 9001 and 9050 blocks and by blocking known Tor guard node IP ranges via your threat intel feed. DNS requests to .onion domains will not resolve through your recursive resolver by default, but DNS over HTTPS (DoH) traffic to an external resolver can bypass local Tor blocking; enforce DoH policy to your internal resolver across all managed endpoints.

Gunra affiliates also use Impacket utilities for lateral movement. Alert on psexec.py, smbclient.py, and secretsdump.py execution on domain controllers and member servers. These tools generate distinctive Windows Security event patterns including EventID 4624 logon type 3 events from unexpected sources and LSASS memory access events.

Applying the Fortinet patch from advisory FG-IR-24-535 is the single most important action to take today. Every unpatched FortiOS 7.0.0 through 7.0.16 device with a management interface reachable from the internet is an active Gunra entry point. The following steps prioritize the actions that close the highest-risk exposure first.

Review FortiOS authentication logs for unexpected admin account creation or authentication events from external IPs on the management interface. Gunra actors create backdoor admin accounts immediately after exploiting the vulnerability. Discovering a newly created admin account indicates the device has already been compromised; patch and rotate, but also initiate full IR and assume the internal network has been accessed.

Gunra represents the convergence of three trends that define the most dangerous ransomware campaigns of 2026. First, the group exploits internet-facing network security appliances as the primary entry point, which means the very devices organizations deploy to protect their networks become the initial access vector. Any organization with an unpatched Fortinet FortiOS 7.0.0 through 7.0.16 management interface exposed to the internet is within Gunra's confirmed target set.

Second, the operational technology attack at the Polish power plant on August 11 demonstrates that Gunra affiliates are willing to target safety-critical industrial systems as part of their extortion strategy. The shutdown of a steam turbine and water treatment system serving 50,000 people elevates Gunra from a standard enterprise ransomware threat to one with confirmed physical-world consequences. Energy, utilities, manufacturing, and healthcare organizations with OT networks connected to IT infrastructure need to treat this advisory as an urgent OT security review trigger, not just an IT patching notice.

Third, the tool-sharing relationship with Lazarus Group documented by AhnLab suggests Gunra affiliates have access to North Korean state-developed exploitation capabilities. This makes the group more technically sophisticated than the typical Conti-lineage ransomware operation. The same privilege escalation tools and command-and-control infrastructure used in state-sponsored espionage operations now appear in financially motivated ransomware attacks against hospitals and government agencies.

Patch FortiOS to 7.0.17 before end of day. Restrict management interface access if patching is delayed. Hunt for the IOCs in this post across your environment now.