FBI Joint Advisory: Gunra Ransomware Is Still Getting In Through Fortinet Firewalls Patched 18 Months Ago

A joint advisory signed by the FBI, CISA, NSA, the Department of Defense Cyber Crime Center, the U.S. Secret Service, and South Korea's National Police Agency landed on August 10 with an unusually blunt message: Gunra ransomware operators are successfully attacking critical infrastructure using vulnerabilities that were disclosed and patched over a year ago. If you run Fortinet firewalls or proxies and haven't applied firmware updates from early 2025, this advisory is addressed to you.

What Gunra Is

Gunra first appeared in April 2025, built from the leaked Conti ransomware source code — the same code dump that has seeded a half-dozen successor operations since 2022. By January 2026, the group had formalized into a ransomware-as-a-service (RaaS) operation, advertising a ransomware builder, management panel, and cross-platform payloads (Windows and Linux) on dark web forums under the alias "Golden Community."

The business model is double extortion: affiliates steal data first, encrypt second, and give victims between five and seven days to pay before exfiltrated files are published on Gunra's Tor-based leak site. The FBI counts 51 confirmed victims since emergence, spanning healthcare, financial services, government agencies, law firms, and nonprofits. Collected ransom has exceeded $10 million. Researchers at Recorded Future have noted that some tooling and infrastructure overlaps with North Korea's Lazarus Group, particularly in attacks on South Korean organizations — though attribution remains cautious.

The Two Fortinet Flaws Doing the Damage

Gunra affiliates get their initial foothold the same way nearly every ransomware campaign does these days: by exploiting internet-facing network appliances that haven't been patched. In this case, two specific CVEs are called out in the advisory:

• CVE-2024-55591 (CVSS 9.6, Critical) — An authentication bypass in Fortinet FortiOS and FortiProxy that exploits the Node.js websocket module. A remote unauthenticated attacker can send specially crafted requests to claim super-administrator privileges on the device with no credentials required. This was disclosed in January 2025 and immediately added to CISA's Known Exploited Vulnerabilities catalog. Affected versions: FortiOS 7.0.0–7.0.16 (patch: 7.0.17+); FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12 (patch: 7.0.20+ and 7.2.13+).
• CVE-2025-24472 (CVSS 8.1, High) — A second Fortinet authentication bypass, this one exploitable via crafted CSF (Content Security Filter) proxy requests, affecting the same FortiOS and FortiProxy version ranges. Also in the KEV catalog. Same patches apply.

The advisory also references attacks against Schneider Electric PowerLogic P5 energy management appliances (CVE-2024-5559), broadening the scope beyond VPN and firewall gear. That detail is relevant for industrial and utilities environments, but the Fortinet angle is the most common exposure for typical businesses.

To be clear about the timeline: CVE-2024-55591 was already being exploited as a zero-day when it was disclosed in January 2025. Patches dropped alongside the disclosure. Eighteen months have now passed. Gunra is still finding victims.

What Happens After the Firewall Falls

Once an affiliate has super-admin access to a Fortinet appliance, the rest is familiar tradecraft. The advisory documents use of Impacket libraries — specifically psexec.py, smbclient.py, and secretsdump.py — for lateral movement and credential harvesting off the network. From there, data exfiltration goes to Microsoft OneDrive, SharePoint, and the MEGA file-sharing service, which are cloud platforms that frequently pass through firewall egress rules unchallenged.

The ransomware payload itself encrypts files using Salsa20/ChaCha20 stream ciphers for speed — the Linux variant claims to support up to 100 parallel encryption threads, allowing it to move through large file stores quickly. RSA-encrypted keys are stored in separate keystore files dropped on the victim system.

Linux Victims: Do Not Pay

One piece of the advisory is particularly worth highlighting for anyone in mixed or Linux-first environments. In March 2026, researchers identified a cryptographic weakness in Gunra's Linux ransomware builds: the encryption key generation relies on a timestamp-based seed that makes key reconstruction possible without the ransomware operator's private key. The advisory explicitly states that Linux victims should not pay the ransom and should engage a reputable incident response firm to attempt recovery. Paying would be handing money to attackers for a key you may not even need.

The Real Problem: Known Exploited Vulnerabilities That Are Still Unpatched

It's tempting to read a ransomware advisory and focus on the threat actor — the North Korea connection, the RaaS model, the affiliate network. But the mechanism here is mundane in the worst way: organizations are getting hit by vulnerabilities that have been public knowledge, with available patches, for over a year. CISA's KEV catalog exists precisely to signal "drop what you're doing and patch this" — and both CVEs have been on that list since early 2025.

The common failure mode is treating edge device firmware like enterprise software: something to update carefully on a long cycle. Firewalls and VPN appliances are the opposite situation. They're exposed directly to the internet, often hold privileged network access, and are exactly the assets attackers probe first. An unpatched FortiOS box is a billboard advertising a working front door.

What to Do Right Now

• Check your Fortinet firmware versions immediately. If you're running FortiOS below 7.0.17 or FortiProxy below 7.2.13, you are vulnerable. The upgrade path is well-documented in Fortinet's advisories. If you have a managed firewall arrangement, confirm with your provider that these have been applied.
• Audit internet-facing management interfaces. If your firewall or VPN management interface is reachable from the public internet, restrict it to specific source IPs or move it off the internet entirely. Many breaches start with a device that had its management port left exposed for convenience.
• Verify MFA everywhere VPN access exists. Gunra uses stolen credentials post-compromise to move laterally. MFA on VPN logins doesn't stop the firewall exploit, but it substantially raises the cost of credential-based lateral movement once an attacker is inside.
• Review egress filtering rules for cloud file services. If MEGA and unmanaged OneDrive endpoints don't need to be reachable from your servers, block them. Egress control is underutilized and cuts off a primary exfiltration channel.
• Test your backups. A double-extortion attack has two levers: data theft and encryption. You can't un-leak data, but you can make the encryption lever irrelevant. Offline, immutable backups that are regularly tested for restore mean encryption becomes an inconvenience, not a catastrophe. This is why restores get drilled.

At Falcon Internet, 24x7x365 NOC monitoring means anomalous egress and off-hours authentication spikes surface before a ransomware payload gets a chance to run — but no monitoring replaces patching the entry point. Start with the firmware versions.