Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA Using Leaked Conti Code
A joint U.S.-South Korea advisory ties the Gunra ransomware-as-a-service crew to a repeatable break-in: two unpatched Fortinet authentication-bypass flaws, defeated MFA, and an encryptor built from leaked Conti code. The fixes have been available since early 2025.
The Gunra ransomware crew has found a repeatable way into critical infrastructure: exploit two known Fortinet authentication-bypass flaws, defeat multi-factor authentication, and run an encryptor built from the leaked Conti codebase. That is the picture a joint U.S. and South Korea advisory drew on August 11, 2026, and it converts a months-old warning about Gunra into a specific, patchable problem for any organization still running an exposed FortiOS or FortiProxy appliance.
Gunra runs as a ransomware-as-a-service (RaaS) operation, which means a core group builds the malware and rents it to affiliates who carry out the intrusions. According to the advisory, those affiliates exploited CVE-2024-55591 and CVE-2025-24472 — two authentication-bypass vulnerabilities in Fortinet's FortiOS and FortiProxy — to seize administrative control of internet-facing firewalls and VPN gateways. Both flaws were patched by Fortinet in early 2025, so the break-ins described here are landing on devices that were never updated.
The single line for a defender to carry away: Gunra affiliates are breaking into critical infrastructure by exploiting two Fortinet authentication-bypass flaws that Fortinet fixed more than a year ago.
Who Issued the Warning
The brief that prompted this story left open whether U.S. authorities had published a joint advisory. As of August 11, 2026, they have. Six agencies co-signed the #StopRansomware: Gunra advisory (AA26-222a): the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Defense Cyber Crime Center, the National Security Agency, the U.S. Secret Service, and South Korea's National Police Agency. It extends the earlier FBI and South Korea warning about Gunra rather than replacing it.
"Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations," said Chris Butera, CISA's acting executive assistant director for cybersecurity, in the agency's statement. The advisory frames the group as an active, financially motivated threat to essential-service providers, not a research curiosity.
The Two Fortinet Flaws to Patch First
Both vulnerabilities are authentication-bypass issues, meaning they let an unauthenticated request reach privileged functions it should never touch. CVE-2024-55591 carries a CVSS score of 9.6 and was disclosed by Fortinet in January 2025 after being exploited as a zero-day. CVE-2025-24472, added to Fortinet's advisory in February 2025, scores 8.1. Fixed firmware for both has been available since early 2025.
If your fleet includes FortiOS or FortiProxy on any internet-facing gateway, treat these two CVEs as the first item on the list. This is the same class of exposure The CyberSignal covered when CISA ordered urgent patching of actively exploited Fortinet FortiSandbox flaws earlier this summer: known bug, available fix, and a window that attackers close faster than most patch cycles.
How the MFA Bypass Fits
The advisory credits Gunra actors with bypassing multi-factor authentication during these intrusions. The specific method is not something to reproduce here, and the practical takeaway does not require it. Because the entry vulnerabilities are authentication bypasses in the appliance itself, an unpatched gateway can surrender administrative access regardless of what MFA policy sits in front of it. Patching the appliance is the control that closes that door; hardening MFA is the control that limits what an attacker can do if they get past other layers.
For defenders that means two parallel checks. Confirm the Fortinet devices are on fixed firmware, and separately confirm that remote access relies on phishing-resistant, bypass-resistant MFA rather than one-time codes that a session-hijacking attacker can reuse. The advisory does not name specific victims, so treat the MFA guidance as general hardening rather than a response to a known compromise at your organization.
The Conti Inheritance
Gunra first appeared in April 2025 and is built on the Conti ransomware source code that leaked in 2022. That lineage matters for detection: Conti-derived families tend to share behavioral fingerprints — encryption routines, extension-handling, and lateral-movement patterns — that mature detection content already recognizes. By early 2026 the operators had moved to the RaaS model and were recruiting affiliates on criminal forums, which is what expanded Gunra from a single crew's tool into a broader threat.
The pattern of a network-appliance flaw feeding a ransomware operation is not unique to Gunra. The CyberSignal documented a close parallel when Dark Reading attributed SonicWall SMA zero-day exploitation to the INC ransomware operation — edge device as the front door, extortion as the payload.
The Scope Behind the Advisory
Reporting on the advisory, including coverage from The Register and BleepingComputer, puts Gunra's confirmed victim count above 50 organizations across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific. Affected sectors skew toward healthcare, government services, financial services, critical manufacturing, transportation, and utilities. Ransom demands in documented cases have frequently exceeded 10 million dollars, and the FBI observed operators emailing victim management directly to pressure payment.
A Rare Break for Defenders
There is one piece of good news in the file. As of March 2026, researchers reported a weakness in Gunra's Linux variant that lets defenders reconstruct decryption keys from file timestamps and recover data without paying — the encryption leaned on a predictable seed. If a Linux system is hit by this variant, the guidance is consistent with long-standing federal advice: do not pay, preserve the encrypted files, and pursue recovery. As always, that path should be validated against the current advisory and a trusted incident-response partner before you rely on it.
My Read
My read: this is a patch-hygiene story wearing a ransomware headline. Gunra's edge here is not a novel exploit — it is two authentication-bypass flaws that Fortinet fixed more than a year ago, still live on internet-facing hardware. The MFA-bypass angle is real and worth taking seriously, but it is downstream of the same problem; a gateway you have not patched is a gateway that can betray the authentication controls around it. The most useful thing a defender can do this week is inventory FortiOS and FortiProxy exposure and confirm the fixed firmware is actually deployed, not merely available. The Conti lineage is the detection gift: because the encryptor is built from familiar code, existing hunt rules have something concrete to catch.
What to Verify This Week
Start with exposure. Identify every internet-facing FortiOS and FortiProxy appliance, confirm the firmware level, and patch anything vulnerable to CVE-2024-55591 or CVE-2025-24472. Verify that remote access enforces phishing-resistant MFA. Load the advisory's indicators into your detection and threat-hunting tooling and look for Conti-lineage behavior. Segment critical infrastructure and OT environments so a single compromised gateway does not open the whole estate. And if you are hit, consult the current advisory and a trusted responder before making any payment decision.
