Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA

1. Executive summary

A ransomware-as-a-service operation tracked as "Gunra" is actively targeting critical infrastructure sectors globally, including financial services, healthcare, and government facilities. According to advisories from CISA, the FBI, and South Korean intelligence agencies, the group gains initial access by exploiting vulnerabilities in firewall and VPN appliances — primarily Fortinet — and bypasses multi-factor authentication (MFA) to breach networks. The operation leverages leaked Conti ransomware code, placing it within a broader trend of established RaaS source code being recycled by new actors. Attribution to "Gunra" is unconfirmed: the actor has no MITRE ATT&CK profile in the verified reference data. Specific exploited CVEs, CVSS scores, and CISA-KEV exploitation states were not available in the source material at time of writing.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	Financial services entities are explicitly named as targets of an active, multi-agency-warned ransomware campaign affecting critical infrastructure.	If a client organisation is compromised or experiences a near-mis via firewall/VPN exploitation, the incident likely meets the threshold for major ICT-related incident reporting under DORA.
DORA Art. 24: digital operational resilience testing — general requirements	The attack vector involves exploitation of known vulnerabilities in externally-facing firewall and VPN appliances.	Clients must ensure their ICT resilience testing programmes include vulnerability scanning and penetration testing of perimeter appliances, not just internal application layers.
NIS2 Art. 23: incident reporting obligations	The campaign targets critical infrastructure sectors with active exploitation by a ransomware actor flagged by national authorities.	NIS2 in-scope organisations experiencing compromise or significant attempted intrusion via these vectors must assess whether the incident triggers the 24-hour early-warning and 72-hour notification obligations.

3. Technical analysis & attack chain

Attribution caveat: The actor "Gunra" has no MITRE ATT&CK profile in the verified reference data. Attribution is based on advisories from CISA, FBI, and South Korean intelligence agencies. Treat the naming as unconfirmed at the MITRE-classification level; the operational details below are sourced from those agency warnings and corroborating reporting.

Confirmed attack chain (reconstructed from source material)

Initial access via firewall/VPN appliance exploitation. Gunra actors exploit vulnerabilities in popular firewall and VPN brands — Fortinet is explicitly named, and Schneider Electric flaws are referenced in related reporting. The specific CVEs, CVSS scores, and whether any are on the CISA KEV catalogue were not provided in the available source material. This is a significant gap: clients should cross-reference the CISA advisory (URL in §7) for the authoritative CVE list.
MFA bypass. After or alongside appliance exploitation, the actors bypass multi-factor authentication mechanisms. The specific MFA bypass technique (e.g., session token theft, MFA fatigue, relay/proxy-based bypass) is not detailed in the available sources. This is single-sourced from the Dark Reading headline and the agency advisory framing; verify the specific mechanism against the full CISA advisory before adjusting MFA controls.
Network breach and lateral movement. The actors establish a foothold inside the target network following the initial access. No specific C2 infrastructure, tooling, or lateral movement techniques are described in the available source material.
Ransomware deployment. Gunra operates as a ransomware-as-a-service (RaaS) operation using leaked Conti ransomware code. This places it in the lineage of Conti-derived variants. Specific payload filenames, encryption behaviour, ransom note content, and extension details are not provided in the sources.
Targeting pattern. Confirmed targeting spans healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. The campaign is global, with advisory issuance from both U.S. (CISA/FBI) and South Korean authorities indicating cross-jurisdictional impact.

What is NOT in the sources (do not assume): No specific CVE identifiers, no CVSS scores, no CISA-KEV entries, no IOCs (IPs, domains, hashes), no command-line artefacts, no registry keys, no file paths, no C2 domains, no ransom note text, and no confirmed MITRE ATT&CK technique IDs are present in the provided material. The full CISA advisory (URL in §7) likely contains these details; this advisory should be updated when that content is retrieved.

4. Mitigation & containment

P1 — Within 24 hours

Cross-reference the CISA advisory directly. The available source material does not contain the specific CVEs being exploited. Retrieve the full advisory at https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-gunra-ransomware-actors-targeting-multiple-critical and immediately map listed CVEs against your Fortinet (and Schneider Electric) asset inventory.
Audit externally-facing firewall/VPN appliances. Inventory all Fortinet FortiGate, FortiAnalyzer, FortiManager, and FortiClient-VPN systems exposed to the internet. Confirm patch levels against the CISA advisory's CVE list once retrieved.
Review MFA implementation. Given the confirmed MFA bypass capability, review MFA configurations for:
Session token lifetimes and replay-resistance.
Whether MFA-protected sessions can be established without completing the second factor via any appliance vulnerability path.
Conditional access policies that may allow bypass from trusted-IP conditions that an appliance compromise could satisfy.
Hunt for Conti-lineage artefacts. Since Gunra uses leaked Conti code, leverage existing Conti detection signatures and threat hunting playbooks as an interim measure until Gunra-specific IOCs are published.

P2 — Within 72 hours

Patch all identified Fortinet and Schneider Electric vulnerabilities to vendor-recommended versions once the CISA advisory CVE list is confirmed. Prioritise any CVEs added to the CISA KEV catalogue.
Network segmentation review. Ensure firewall management interfaces are not accessible from the internet. Restrict management plane access to jump hosts on isolated management VLANs.
Enable and verify logging. Confirm Fortinet appliances are forwarding logs to SIEM with retention sufficient for incident investigation. Focus on authentication events, admin session creation, and configuration changes.
Brief SOC / IR teams. Ensure the incident response runbook covers Conti-lineage ransomware containment (known Conti TTPs include Cobalt Strike, Kerberos ticket abuse, and volume shadow copy deletion — verify against the full CISA advisory before operationalising).

P3 — Within 7 days

Threat hunt across the estate. Using Conti-lineage behavioural indicators as a baseline, hunt for signs of post-exploitation activity: suspicious service creation, scheduled task creation matching known Conti patterns, mass file access preceding encryption, and unusual SMB/RDP lateral movement.
Validate backup integrity. Confirm offline/immutable backups exist and are test-restorable. Conti-lineage variants typically attempt backup destruction.
Engage third-party risk teams. If Fortinet or Schneider Electric appliances are managed by a third-party MSSP, confirm patch status and incident notification clauses (relevant to DORA Art. 30).

5. Indicators of compromise

No indicators of compromise available in the source material. The provided sources do not contain atomic IOCs (IPs, domains, hashes, filenames, or registry keys). The full CISA advisory at the URL in §7 is the likely authoritative source for IOCs; retrieve and integrate before enforcement.

Behavioural indicators (derived from source descriptions — single-sourced; verify before enforcement):

Behaviour	Where to observe	Confidence
Exploitation of Fortinet firewall/VPN vulnerabilities	Firewall/VPN appliance logs; IDS/IPS signatures for Fortinet CVEs (retrieve specific CVEs from CISA advisory)	Medium — confirmed by multi-agency advisory but specific CVEs not yet retrieved
MFA bypass following appliance exploitation	Identity provider logs; VPN authentication logs; anomalous session establishment without MFA completion	Medium — confirmed capability, specific technique unknown
Conti-lineage ransomware deployment	Endpoint EDR; file system monitoring for mass file modification/encryption; volume shadow copy deletion events	Medium — code lineage confirmed, specific payload artefacts not yet available

6. Detection

Insufficient indicators to author detection rules. The available source material does not contain distinctive strings, command-line flags, mutex names, file paths, registry keys, ransom-note text, or hard-coded values specific to the Gunra payload. Until the full CISA advisory is retrieved with Gunra-specific IOCs and artefacts, organisations should apply existing Conti-lineage YARA and Sigma rules as a stopgap. Do not treat Conti-generic detections as Gunra-confirmed.

7. Sources

Dark Reading — "Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA" — https://www.darkreading.com/cyberattacks-data-breaches/gunra-ransomware-gang-fortinet-flaws-bypasses-mfa — 2026-08-11
The Hacker News — "Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks" — https://thehackernews.com/2026/08/gunra-ransomware-exploits-fortinet-and.html — 2026-08-11
CISA — "CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors" — https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-gunra-ransomware-actors-targeting-multiple-critical — 2026-08-11
The Record (Recorded Future) — "FBI, South Korea warn of Gunra ransomware gang targeting critical infrastructure" — https://therecord.media/ransomware-south-korea-fbi-gunra — 2026-08-11

8. Adverse Trace position

This is an active, multi-agency-confirmed ransomware campaign directly targeting financial services organisations. The use of leaked Conti code means existing Conti-era detections and playbooks provide a partial interim defensive baseline, but Gunra-specific IOCs and CVE details are absent from the currently available source material and must be retrieved from the full CISA advisory before enforcement actions are finalised. Attribution to "Gunra" is unconfirmed at the MITRE ATT&CK classification level (no profile exists in verified reference data), though the operational reporting is corroborated across CISA, FBI, South Korean authorities, and multiple independent media outlets. We assess the risk to EMEA financial services clients as elevated given the explicit targeting of the sector and the MFA-bypass capability. Adverse Trace will issue an updated advisory — including specific CVEs, CVSS scores, KEV status, and IOCs — once the full CISA advisory content is retrieved and parsed. Clients should action the P1 items in §4 immediately and not wait for the update.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.