Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption

Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption 1. Basic Information Severity: Critical Title: #StopRansomware: Gunra Ransomware (AA26-222A) Publishers: CISA / FBI / DC3 / NSA / USSS / Korean National Police Agency (KNPA) Publication Date: 2026-08-10 Original Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a Primary PDF: https://media.defense.gov/2026/Aug/10/2003976697/-1/-1/0/CSA_STOPRANSOMWARE_GUNRA_RANSOMWARE.PDF Related Sources: NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/ BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ Related Malware, Groups, CVEs, and Products: Gunra, Golden Community, Conti variant, CVE-2024-55591, CVE-2025-24472, FortiOS, FortiProxy, SSL-VPN, VDI, Active Directory, Hiware, OneDrive, SharePoint, Mega, Sliver, Impacket, RClone 2. Executive Summary This is a double-extortion Ransomware-as-a-Service (RaaS) that enters networks through FortiGate/VPN authentication bypasses or default credentials. It modifies VPN traffic to steal sessions, implants static OTP backdoors into VDI authentication processes, steals dozens of terabytes of data from Active Directory, management servers, and SaaS platforms, and finally encrypts Windows and Linux systems. 3. Attack Flow Chain A: Fortinet-Initiated (Observed by FBI) Exploits CVE-2024-55591 or CVE-2025-24472 on internet-facing FortiOS/FortiProxy to bypass authentication. Gains access to the firewall/SSL-VPN and performs internal reconnaissance. Performs SMB lateral movement using Impacket's psexec.py or smbclient.py. Executes secretsdump.py on the domain controller to retrieve password hashes derived from NTDS.dit. Moves to privileged system accounts using pass-the-hash/pass-the-ticket techniques. Collects, compresses, and exfiltrates data using main.exe (for OneDrive/SharePoint), RClone, 7-Zip, WinRAR, and FileZilla. Deletes Volume Shadow Copies via WMI/WMIC and destroys both primary and Disaster Recovery (DR) backups. Deploys the Gunra encryptor to encrypt target files using ChaCha20 + RSA-4096, appending .ENCRT or .CRYPT. Demands payment within 5 to 7 days using R3ADM3.txt, a Tor negotiation portal, and qTox. Chain B: VPN and VDI Authentication Compromise (Observed by KNPA) Exploits credential exposure or SSH access control vulnerabilities on internet-facing VPN gateways, or uses default credentials without lockout mechanisms. Reaches the SSL-VPN administrator account, downloads OpenSSH from an external server, and builds a tunnel. Accesses the SSL-VPN management console from an internet-connected network administrator workstation. Identifies an unused account that can reach both the internet and internal networks, and modifies settings to bypass mandatory password changes. Modifies the VPN traffic control functions to collect credentials and session information sent to the VDI portal. Hijacks VDI sessions using stolen session cookies, and performs RDP lateral movement to VDI authentication servers, AD servers, and IT staff virtual desktops. Modifies the VDI authentication processing file to create an MFA bypass where a specific attacker-defined OTP always succeeds. Connects via SSH from the compromised VDI to the Hiware access control server and steals symmetric keys. Uses the keys to decrypt enterprise server passwords in the database, obtaining credentials for all servers. Gathers network architecture documents from the IT staff VDI and distributes ransomware to database servers and NAS devices. Chain C: Collection, Encryption, and Extortion Filters documents, databases, PII, internal emails, and network diagrams. Collects local data using main.exe for OneDrive/SharePoint and archive tools for local files. Exfiltrates data to Mega, FTP, or RClone. Observed cases reached dozens of terabytes. Enumerates A–Z drives, excludes system-critical paths and extensions, and adds user data to a work queue. Encrypts files using multi-threading and deletes shadow copies and backups. Previews OneDrive/SharePoint directory listings on a leak site, threatening to sell or publish data if payment is not made. 4. Attacker Positions and Execution Locations External Attacker / Affiliate: Enters through internet-facing management interfaces such as FortiGate, VPN, RDP, and SSH. Perimeter Devices: Used for exploits, credential/session capture, OpenSSH tunneling, and account modification. Admin Workstations & VDIs: Act as pivot points for SSL-VPN management, cookie hijacking, RDP pivoting, and gathering network diagrams. AD & Access Control Servers: Locations for acquiring NTDS.dit hashes and server password decryption keys. SaaS & Cloud: OneDrive/SharePoint are targets for collection via main.exe, while Mega and others serve as exfiltration destinations. Servers, NAS, & Backups: The final targets for ransomware execution and recovery disruption. Tor & qTox: Communication channels for negotiation, extortion, and leak sales. 5. Perspectives of Users and Administrators Users VPN/VDI logins appear normal because valid cookies or specified OTPs are used. Nighttime RDP sessions appear on IT staff virtual desktops. File extensions change to .ENCRT/.CRYPT, and R3ADM3.txt appears in the final stage. Administrators & SOCs FortiGate authentication bypasses, default account attempts, and continuous logins without account lockout. Password-change policy changes on unused VPN accounts. VPN traffic-control settings and unexpected modifications to VDI authentication files. Chained access from admin workstations to VPN consoles, VDIs, AD, and Hiware. Execution of secretsdump.py, psexec.py, smbclient.py, Mimikatz, Sliver, RClone, 7-Zip, and FileZilla. Internal reconnaissance between 22:00 and 06:00, along with the deletion of command history and system/network logs. Mass enumeration/downloads from OneDrive/SharePoint, and large data transfers to Mega or similar services. Deletion of shadow copies via WMI and destructive operations on both primary and DR backups. The encryptor itself generates no DNS or HTTP traffic, making endpoint behavior critical. 6. Success and Failure Conditions for Attackers Success Conditions Unpatched FortiOS/FortiProxy and VPN/SSH access-control vulnerabilities are exposed to the internet. Default credentials, missing account lockouts, and unused accounts remain active. Admin workstations can reach perimeter device management consoles and internal critical systems. Integrity monitoring for VPN configurations, VDI authentication files, and OTP processing is absent. SMB/RDP/SSH to the Domain Controller (DC) is widely permitted, and Impacket cannot be blocked. Access-control database encryption keys and databases reside within the same trust boundary. Mass SaaS downloads and outbound egress are permitted. Backups are online and accessible from production credentials/networks. Failure Conditions CVE-2024-55591 and CVE-2025-24472 are patched, and internet-facing management interfaces are restricted. Default/unused accounts are removed, and lockouts with phishing-resistant MFA are enforced. VPN configs, VDI authentication files, and OTP processes are signed and monitored. Admin workstations are tiered, separating perimeter management from AD management. SMB/RDP, service creation, and NTDS access to the DC are minimized and detected. SaaS downloads and outbound traffic are controlled by volume, device, and time. Immutable/offline backups are maintained with separate credentials and networks, and regular restore tests are conducted. 7. What Happens Upon Attack Success VPN/VDI sessions and static OTP backdoors may persist even after password resets. Domain hashes, enterprise server passwords, and network diagrams are handed over to the attacker. Dozens of terabytes of OneDrive/SharePoint data, local files, emails, and PII can be stolen. Database servers, NAS devices, and Windows/Linux endpoints are encrypted. Shadow copies, primary backups, and DR backups are deleted, extending recovery times. High payments are demanded via leak sites, emails to management, and Tor/qTox. 8. Observable Logs Email Collection and export of internal emails. Direct ransom solicitation emails sent to executives. Contacts from Gunra-related negotiation addresses. Proxy / SWG / DNS OpenSSH or tool downloads from attacker-controlled servers. Large uploads to Mega, FTP, or RClone cloud storage. Tor negotiation, leak site, and qTox-related traffic. Sliver C2 and known IOC communications. The standalone encryptor generates no DNS or HTTP traffic. Endpoint / EDR Impacket tools: psexec.py, smbclient.py, secretsdump.py. Remote service creation, SMB admin shares, RDP, and OpenSSH tunnels. Access to OneDrive/SharePoint via main.exe. Abnormal use of 7-Zip, WinRAR, RClone, FileZilla, Mimikatz, Sliver, and AnyDesk. wmic shadowcopy ... delete, A–Z drive enumeration, and multi-thread encryption. Files named .ENCRT/.CRYPT and R3ADM3.txt. Deletion of command history, event/network logs, and use of IsDebuggerPresent. Identity / IdP Successful logins and policy changes on VPN default/unused accounts. VDI sessions using stolen cookies, missing MFA challenges, or repeated success with identical OTP values. Nighttime admin logins and RDP to multiple IT VDIs. Pass-the-hash/pass-the-ticket and abnormal service account usage. Rapid utilization of numerous server credentials from Hiware. SaaS / Cloud Mass listing/downloads of OneDrive/SharePoint files by non-standard clients like main.exe. Sudden surges in download volumes per account, followed immediately by outbound transfers after archiving. Uploads to unapproved storage providers like Mega. Network Chains of activity from internet to FortiGate/VPN, VPN to VDI, and VDI to AD/Hiware. Lateral movement over SMB/445, RDP/3389, and SSH/22. Abnormal nighttime access from admin workstations to perimeter consoles. Operations targeting both primary and DR backups originating from the same actor. 9. Attack Success Evaluation Contact Only: Exploit probes, failed VPN logins, or communication with IOCs without internal sessions. Initial Access Suspected: Abnormal FortiGate logins, successful default account use, OpenSSH downloads. Authentication Success / Session Compromise: Valid VPN cookies, VDI session hijacking, unused account modifications. Persistent Authentication Success: Repeatable logins using attacker-specified OTPs and modified authentication files. Credential Access Success: secretsdump output, NTDS hashes, Hiware keys/decrypted passwords obtained. Lateral Movement Success: Established sessions via RDP/SMB/SSH to AD, IT VDIs, databases, and NAS. Data Theft Success: Archiving of SaaS/local data and completion of transmission to external storage (enumeration alone does not count as success). Impact Success: Shadow copy/backup deletion, .ENCRT/.CRYPT files, and ransom notes. 10. Investigation Playbook Triggers FortiGate CVE exploitation, VPN account modifications, VDI authentication file tampering. Execution of secretsdump.py or main.exe, shadow copy deletion, mass downloads from OneDrive/SharePoint. Appearance of .ENCRT files or R3ADM3.txt. Initial Verification Identify the first successful session on FortiGate, VPN, SSH, RDP, and VDI. Combine accounts, cookies, source IPs, admin workstations, and device IDs into a single timeline. Compare VPN configurations and VDI authentication files against known-good baselines. Preserve SaaS and egress evidence before encryption occurs; do not treat it as a standard ransomware incident. Endpoints Confirm the execution of Impacket, Sliver, Mimikatz, OpenSSH, RClone, FileZilla, 7-Zip, and AnyDesk. Preserve process trees, service creation artifacts, prefetch files, PowerShell/cmd histories, and RDP artifacts. Check main.exe hashes, archive paths, .ENCRT files, ransom notes, and WMIC histories. If event logs are deleted, supplement findings with EDR telemetry, network logs, and remote log collectors. Authentication & Cloud Revoke all VPN/VDI tokens, and disable unused/default accounts as well as attacker-created accounts. Rebuild OTP processing from clean packages and verify resistance against fixed-value bypasses. Rotate NTDS and Hiware credentials across tiers, assuming they were compromised. Review OneDrive/SharePoint audit logs for listings, downloads, apps/clients, and volumes. Subsequent Operations Cross-examine SMB/RDP/SSH sessions, DC credential dumps, and pass-the-hash/ticket activities. Verify access to primary and DR backups and confirm deletion timestamps. Check transfer volumes for Mega, FTP, and RClone, and verify object existence at destinations. Preserve emails sent to management, Tor/qTox chats, and leak previews as evidence. Containment Isolate and patch vulnerable gateways, and revert configurations to clean baselines. Staged revocation and rotation of sessions, tokens, and credentials. Network-isolate DCs, backups, and SaaS management, and restrict lateral movement protocols. Block exfiltration channels and make immutable backups inaccessible to attackers. Rebuild VDIs suspected of having compromised authentication files. Evaluation Stages Scanning → Initial Access → Session Compromise → MFA Bypass Persistence → Credential Access → Lateral Movement → Collection → Exfiltration → Encryption/Recovery Inhibition 11. Defense and Detection Ideas Single Events FortiGate exploit signatures or admin logins from unknown sources. Removal of password-change policies on unused VPN accounts. Changes to VDI authentication file hashes. Execution of secretsdump.py, wmic shadowcopy delete, or creation of .ENCRT files. Mass downloads from OneDrive/SharePoint by non-standard clients. Timeline Correlation FortiGate/VPN Intrusion → Unused Account Modification → OpenSSH Tunnel → VDI Cookie Theft → Static OTP Bypass → Lateral Movement to IT VDI/AD/Hiware → OneDrive/SharePoint Collection → Mega/FTP Transfer → Backup Deletion → Gunra Encryption Threat Hunting Perspectives Perimeter management, VDI, and AD operations between 22:00 and 06:00. Missing MFA events after successful logins, repeated success with identical OTPs, and cookie reuse. Access from admin workstations to both perimeter consoles and the DC. RDP/SMB service creation or SaaS downloads following secretsdump execution. Closely timed backup deletions across both primary and DR environments. Do not judge legitimate tools in isolation; correlate them with actors, timing, and preceding/succeeding behaviors. Common Log Gaps FortiGate config audits, VPN traffic-control changes, VDI file integrity checks, Hiware access logs, SaaS file audits, backup admin audits, and East-West traffic flows are frequently missing. Priority Countermeasures Emergency patching of known-exploited FortiOS/FortiProxy CVEs and restriction of management interfaces. Removal of unused/default accounts, enforcement of lockouts, and deployment of phishing-resistant MFA. Integrity monitoring for VPN and VDI authentication components. Administrative tiering and network segmentation for DCs and backups. Controls on mass SaaS downloads and unauthorized storage uploads. Offline immutable backups and regular restore drills using independent credentials. 12. Facts, Inferences, and Hypotheses Facts The FBI observed two FortiOS/FortiProxy authentication bypass CVEs used for initial access. The KNPA observed VPN credential/session capture, VDI cookie hijacking, and MFA bypass via static OTPs. Attackers obtained NTDS hashes using Impacket and moved laterally via SMB/RDP/SSH. main.exe targeted OneDrive and SharePoint, exfiltrating dozens of terabytes in one observed incident. Gunra performs multi-thread encryption using ChaCha20 + RSA-4096, and the standalone encryptor generates no DNS or HTTP traffic. Deletion of backups in both primary data centers and DR centers was confirmed in some cases. Inferences Patching VPNs alone cannot remove already created accounts, cookies, OTP backdowns, or OpenSSH tunnels. Encryption detection happens at the final stage; mass SaaS downloads and tampering with authentication components serve as earlier points of interception. Organizations facing similar architectures—combining FortiGate, VDI, Hiware-like privileged access management, and M365—share the same attack surface globally. Hypotheses Correlating four factors—VPN config changes, VDI file hashes, repeated identical OTP successes, and cookie reuse—may enable early detection of MFA bypasses. Correlating backup deletions across primary and DR environments can help distinguish between routine maintenance and ransomware preparation with high accuracy. 13. MITRE ATT&CK Mapping High Confidence (Based on Joint Advisory Observations and Mappings) T1190 – Exploit Public-Facing Application T1133 – External Remote Services T1078.001 / T1078.002 – Valid Accounts T1105 – Ingress Tool Transfer T1572 – Protocol Tunneling T1098 – Account Manipulation T1021.001 / T1021.002 – RDP / SMB Windows Admin Shares T1003.003 – NTDS T1550.002 / T1550.003 – Pass the Hash / Pass the Ticket T1040 – Network Sniffing T1539 – Steal Web Session Cookie T1556.006 – Multi-Factor Authentication T1555 – Credentials from Password Stores T1070.003 – Clear Command History T1083 – File and Directory Discovery T1114 – Email Collection T1005 – Data from Local System T1530 – Data from Cloud Storage T1560 – Archive Collected Data T1567 / T1048 – Exfiltration Over Web Service / Alternative Protocol T1047 / T1059.003 – WMI / Windows Command Shell T1490 – Inhibit System Recovery T1486 – Data Encrypted for Impact Supplementary Notes The joint advisory also references ATT&CK v19.1 techniques T1678 (operational timing, such as nighttime activity), T1679 (encryption filtering), and T1685 (clearing network access logs). If your SOC platform uses older versions, retain these as custom tags. 14. Unknowns and Additional Investigations Initial access methods and C2 differences among affiliates. Complete IOCs for static OTP values, modified file names, and VPN traffic-control modifications. Detailed mechanics on whether main.exe utilizes M365 APIs, sync clients, or browser sessions. Full execution and encryption specifications for the Linux variant. Current active Tor addresses, qTox IDs, and infrastructure expiration dates. Correlation between data successfully saved at exfiltration destinations and leak previews. 15. Impact on SOCs and General Enterprises Architectures featuring FortiGate/FortiProxy, SSL-VPN, VDI, Active Directory, M365, privileged access management, NAS, and dual-site backups are common across global enterprises. Rather than attacking each component in isolation, Gunra leverages them as a continuous chain centered around perimeter administrator workstations. Crucially, MFA bypasses are implemented not merely through OTP phishing, but via tampering with authentication processing files combined with session cookies. Password resets or re-registering MFA are insufficient; rebuilding VPN/VDI components and revoking tokens are necessary. SOCs should not wait for encryption alerts; instead, they must integratively monitor FortiGate configuration changes, nighttime VDIs, NTDS access, mass M365 downloads, and primary/DR backup operations. 16. Summaries by Target Audience For SOCs Build cross-domain timelines spanning FortiGate → VDI → AD/Hiware → M365 → backups. Treat successful identical OTP logins, cookie reuse, and authentication file modifications as MFA bypasses. Distinguish between enumeration and successful exfiltration by verifying archive creation and SaaS/Mega transfers. For Administrators Patch Fortinet CVEs and remove default/unused accounts as well as internet-facing management surfaces. Implement administrative tiering, integrity monitoring for VPN/VDI files, and immutable backups with independent credentials. During a breach, rotate not only passwords but also tokens, cookies, OTP handlers, and access-control keys. For Users Immediately report unusual MFA behaviors or unexpected sessions on VPNs or VDIs. If ransom notes or changed file extensions appear, do not operate or reboot the device; request network isolation from the SOC. Do not reply to emails from attackers demanding payment; forward them to legal, management, and incident response teams.