Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption
1. Basic Information
- Severity: Critical
- Title: #StopRansomware: Gunra Ransomware (AA26-222A)
- Publishers: CISA / FBI / DC3 / NSA / USSS / Korean National Police Agency (KNPA)
- Publication Date: 2026-08-10
- Original Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a
- Primary PDF: https://media.defense.gov/2026/Aug/10/2003976697/-1/-1/0/CSA_STOPRANSOMWARE_GUNRA_RANSOMWARE.PDF
-
Related Sources:
- NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/
- Related Malware, Groups, CVEs, and Products: Gunra, Golden Community, Conti variant, CVE-2024-55591, CVE-2025-24472, FortiOS, FortiProxy, SSL-VPN, VDI, Active Directory, Hiware, OneDrive, SharePoint, Mega, Sliver, Impacket, RClone
2. Executive Summary
This is a double-extortion Ransomware-as-a-Service (RaaS) that enters networks through FortiGate/VPN authentication bypasses or default credentials. It modifies VPN traffic to steal sessions, implants static OTP backdoors into VDI authentication processes, steals dozens of terabytes of data from Active Directory, management servers, and SaaS platforms, and finally encrypts Windows and Linux systems.
3. Attack Flow
Chain A: Fortinet-Initiated (Observed by FBI)
- Exploits
CVE-2024-55591orCVE-2025-24472on internet-facing FortiOS/FortiProxy to bypass authentication. - Gains access to the firewall/SSL-VPN and performs internal reconnaissance.
- Performs SMB lateral movement using Impacket's
psexec.pyorsmbclient.py. - Executes
secretsdump.pyon the domain controller to retrieve password hashes derived fromNTDS.dit. - Moves to privileged system accounts using pass-the-hash/pass-the-ticket techniques.
- Collects, compresses, and exfiltrates data using
main.exe(for OneDrive/SharePoint), RClone, 7-Zip, WinRAR, and FileZilla. - Deletes Volume Shadow Copies via WMI/WMIC and destroys both primary and Disaster Recovery (DR) backups.
- Deploys the Gunra encryptor to encrypt target files using ChaCha20 + RSA-4096, appending
.ENCRTor.CRYPT. - Demands payment within 5 to 7 days using
R3ADM3.txt, a Tor negotiation portal, and qTox.
Chain B: VPN and VDI Authentication Compromise (Observed by KNPA)
- Exploits credential exposure or SSH access control vulnerabilities on internet-facing VPN gateways, or uses default credentials without lockout mechanisms.
- Reaches the SSL-VPN administrator account, downloads OpenSSH from an external server, and builds a tunnel.
- Accesses the SSL-VPN management console from an internet-connected network administrator workstation.
- Identifies an unused account that can reach both the internet and internal networks, and modifies settings to bypass mandatory password changes.
- Modifies the VPN traffic control functions to collect credentials and session information sent to the VDI portal.
- Hijacks VDI sessions using stolen session cookies, and performs RDP lateral movement to VDI authentication servers, AD servers, and IT staff virtual desktops.
- Modifies the VDI authentication processing file to create an MFA bypass where a specific attacker-defined OTP always succeeds.
- Connects via SSH from the compromised VDI to the Hiware access control server and steals symmetric keys.
- Uses the keys to decrypt enterprise server passwords in the database, obtaining credentials for all servers.
- Gathers network architecture documents from the IT staff VDI and distributes ransomware to database servers and NAS devices.
Chain C: Collection, Encryption, and Extortion
- Filters documents, databases, PII, internal emails, and network diagrams.
- Collects local data using
main.exefor OneDrive/SharePoint and archive tools for local files. - Exfiltrates data to Mega, FTP, or RClone. Observed cases reached dozens of terabytes.
- Enumerates A–Z drives, excludes system-critical paths and extensions, and adds user data to a work queue.
- Encrypts files using multi-threading and deletes shadow copies and backups.
- Previews OneDrive/SharePoint directory listings on a leak site, threatening to sell or publish data if payment is not made.
4. Attacker Positions and Execution Locations
- External Attacker / Affiliate: Enters through internet-facing management interfaces such as FortiGate, VPN, RDP, and SSH.
- Perimeter Devices: Used for exploits, credential/session capture, OpenSSH tunneling, and account modification.
- Admin Workstations & VDIs: Act as pivot points for SSL-VPN management, cookie hijacking, RDP pivoting, and gathering network diagrams.
-
AD & Access Control Servers: Locations for acquiring
NTDS.dithashes and server password decryption keys. -
SaaS & Cloud: OneDrive/SharePoint are targets for collection via
main.exe, while Mega and others serve as exfiltration destinations. - Servers, NAS, & Backups: The final targets for ransomware execution and recovery disruption.
- Tor & qTox: Communication channels for negotiation, extortion, and leak sales.
5. Perspectives of Users and Administrators
Users
- VPN/VDI logins appear normal because valid cookies or specified OTPs are used.
- Nighttime RDP sessions appear on IT staff virtual desktops.
- File extensions change to
.ENCRT/.CRYPT, andR3ADM3.txtappears in the final stage.
Administrators & SOCs
- FortiGate authentication bypasses, default account attempts, and continuous logins without account lockout.
- Password-change policy changes on unused VPN accounts.
- VPN traffic-control settings and unexpected modifications to VDI authentication files.
- Chained access from admin workstations to VPN consoles, VDIs, AD, and Hiware.
- Execution of
secretsdump.py,psexec.py,smbclient.py, Mimikatz, Sliver, RClone, 7-Zip, and FileZilla. - Internal reconnaissance between 22:00 and 06:00, along with the deletion of command history and system/network logs.
- Mass enumeration/downloads from OneDrive/SharePoint, and large data transfers to Mega or similar services.
- Deletion of shadow copies via WMI and destructive operations on both primary and DR backups.
- The encryptor itself generates no DNS or HTTP traffic, making endpoint behavior critical.
6. Success and Failure Conditions for Attackers
Success Conditions
- Unpatched FortiOS/FortiProxy and VPN/SSH access-control vulnerabilities are exposed to the internet.
- Default credentials, missing account lockouts, and unused accounts remain active.
- Admin workstations can reach perimeter device management consoles and internal critical systems.
- Integrity monitoring for VPN configurations, VDI authentication files, and OTP processing is absent.
- SMB/RDP/SSH to the Domain Controller (DC) is widely permitted, and Impacket cannot be blocked.
- Access-control database encryption keys and databases reside within the same trust boundary.
- Mass SaaS downloads and outbound egress are permitted.
- Backups are online and accessible from production credentials/networks.
Failure Conditions
-
CVE-2024-55591andCVE-2025-24472are patched, and internet-facing management interfaces are restricted. - Default/unused accounts are removed, and lockouts with phishing-resistant MFA are enforced.
- VPN configs, VDI authentication files, and OTP processes are signed and monitored.
- Admin workstations are tiered, separating perimeter management from AD management.
- SMB/RDP, service creation, and NTDS access to the DC are minimized and detected.
- SaaS downloads and outbound traffic are controlled by volume, device, and time.
- Immutable/offline backups are maintained with separate credentials and networks, and regular restore tests are conducted.
7. What Happens Upon Attack Success
- VPN/VDI sessions and static OTP backdoors may persist even after password resets.
- Domain hashes, enterprise server passwords, and network diagrams are handed over to the attacker.
- Dozens of terabytes of OneDrive/SharePoint data, local files, emails, and PII can be stolen.
- Database servers, NAS devices, and Windows/Linux endpoints are encrypted.
- Shadow copies, primary backups, and DR backups are deleted, extending recovery times.
- High payments are demanded via leak sites, emails to management, and Tor/qTox.
8. Observable Logs
- Collection and export of internal emails.
- Direct ransom solicitation emails sent to executives.
- Contacts from Gunra-related negotiation addresses.
Proxy / SWG / DNS
- OpenSSH or tool downloads from attacker-controlled servers.
- Large uploads to Mega, FTP, or RClone cloud storage.
- Tor negotiation, leak site, and qTox-related traffic.
- Sliver C2 and known IOC communications.
- The standalone encryptor generates no DNS or HTTP traffic.
Endpoint / EDR
- Impacket tools:
psexec.py,smbclient.py,secretsdump.py. - Remote service creation, SMB admin shares, RDP, and OpenSSH tunnels.
- Access to OneDrive/SharePoint via
main.exe. - Abnormal use of 7-Zip, WinRAR, RClone, FileZilla, Mimikatz, Sliver, and AnyDesk.
-
wmic shadowcopy ... delete, A–Z drive enumeration, and multi-thread encryption. - Files named
.ENCRT/.CRYPTandR3ADM3.txt. - Deletion of command history, event/network logs, and use of
IsDebuggerPresent.
Identity / IdP
- Successful logins and policy changes on VPN default/unused accounts.
- VDI sessions using stolen cookies, missing MFA challenges, or repeated success with identical OTP values.
- Nighttime admin logins and RDP to multiple IT VDIs.
- Pass-the-hash/pass-the-ticket and abnormal service account usage.
- Rapid utilization of numerous server credentials from Hiware.
SaaS / Cloud
- Mass listing/downloads of OneDrive/SharePoint files by non-standard clients like
main.exe. - Sudden surges in download volumes per account, followed immediately by outbound transfers after archiving.
- Uploads to unapproved storage providers like Mega.
Network
- Chains of activity from internet to FortiGate/VPN, VPN to VDI, and VDI to AD/Hiware.
- Lateral movement over SMB/445, RDP/3389, and SSH/22.
- Abnormal nighttime access from admin workstations to perimeter consoles.
- Operations targeting both primary and DR backups originating from the same actor.
9. Attack Success Evaluation
- Contact Only: Exploit probes, failed VPN logins, or communication with IOCs without internal sessions.
- Initial Access Suspected: Abnormal FortiGate logins, successful default account use, OpenSSH downloads.
- Authentication Success / Session Compromise: Valid VPN cookies, VDI session hijacking, unused account modifications.
- Persistent Authentication Success: Repeatable logins using attacker-specified OTPs and modified authentication files.
-
Credential Access Success:
secretsdumpoutput, NTDS hashes, Hiware keys/decrypted passwords obtained. - Lateral Movement Success: Established sessions via RDP/SMB/SSH to AD, IT VDIs, databases, and NAS.
- Data Theft Success: Archiving of SaaS/local data and completion of transmission to external storage (enumeration alone does not count as success).
-
Impact Success: Shadow copy/backup deletion,
.ENCRT/.CRYPTfiles, and ransom notes.
10. Investigation Playbook
Triggers
- FortiGate CVE exploitation, VPN account modifications, VDI authentication file tampering.
- Execution of
secretsdump.pyormain.exe, shadow copy deletion, mass downloads from OneDrive/SharePoint. - Appearance of
.ENCRTfiles orR3ADM3.txt.
Initial Verification
- Identify the first successful session on FortiGate, VPN, SSH, RDP, and VDI.
- Combine accounts, cookies, source IPs, admin workstations, and device IDs into a single timeline.
- Compare VPN configurations and VDI authentication files against known-good baselines.
- Preserve SaaS and egress evidence before encryption occurs; do not treat it as a standard ransomware incident.
Endpoints
- Confirm the execution of Impacket, Sliver, Mimikatz, OpenSSH, RClone, FileZilla, 7-Zip, and AnyDesk.
- Preserve process trees, service creation artifacts, prefetch files, PowerShell/cmd histories, and RDP artifacts.
- Check
main.exehashes, archive paths,.ENCRTfiles, ransom notes, and WMIC histories. - If event logs are deleted, supplement findings with EDR telemetry, network logs, and remote log collectors.
Authentication & Cloud
- Revoke all VPN/VDI tokens, and disable unused/default accounts as well as attacker-created accounts.
- Rebuild OTP processing from clean packages and verify resistance against fixed-value bypasses.
- Rotate NTDS and Hiware credentials across tiers, assuming they were compromised.
- Review OneDrive/SharePoint audit logs for listings, downloads, apps/clients, and volumes.
Subsequent Operations
- Cross-examine SMB/RDP/SSH sessions, DC credential dumps, and pass-the-hash/ticket activities.
- Verify access to primary and DR backups and confirm deletion timestamps.
- Check transfer volumes for Mega, FTP, and RClone, and verify object existence at destinations.
- Preserve emails sent to management, Tor/qTox chats, and leak previews as evidence.
Containment
- Isolate and patch vulnerable gateways, and revert configurations to clean baselines.
- Staged revocation and rotation of sessions, tokens, and credentials.
- Network-isolate DCs, backups, and SaaS management, and restrict lateral movement protocols.
- Block exfiltration channels and make immutable backups inaccessible to attackers.
- Rebuild VDIs suspected of having compromised authentication files.
Evaluation Stages
Scanning → Initial Access → Session Compromise → MFA Bypass Persistence → Credential Access → Lateral Movement → Collection → Exfiltration → Encryption/Recovery Inhibition
11. Defense and Detection Ideas
Single Events
- FortiGate exploit signatures or admin logins from unknown sources.
- Removal of password-change policies on unused VPN accounts.
- Changes to VDI authentication file hashes.
- Execution of
secretsdump.py,wmic shadowcopy delete, or creation of.ENCRTfiles. - Mass downloads from OneDrive/SharePoint by non-standard clients.
Timeline Correlation
FortiGate/VPN Intrusion → Unused Account Modification → OpenSSH Tunnel
→ VDI Cookie Theft → Static OTP Bypass → Lateral Movement to IT VDI/AD/Hiware
→ OneDrive/SharePoint Collection → Mega/FTP Transfer → Backup Deletion → Gunra Encryption
Threat Hunting Perspectives
- Perimeter management, VDI, and AD operations between 22:00 and 06:00.
- Missing MFA events after successful logins, repeated success with identical OTPs, and cookie reuse.
- Access from admin workstations to both perimeter consoles and the DC.
- RDP/SMB service creation or SaaS downloads following
secretsdumpexecution. - Closely timed backup deletions across both primary and DR environments.
- Do not judge legitimate tools in isolation; correlate them with actors, timing, and preceding/succeeding behaviors.
Common Log Gaps
- FortiGate config audits, VPN traffic-control changes, VDI file integrity checks, Hiware access logs, SaaS file audits, backup admin audits, and East-West traffic flows are frequently missing.
Priority Countermeasures
- Emergency patching of known-exploited FortiOS/FortiProxy CVEs and restriction of management interfaces.
- Removal of unused/default accounts, enforcement of lockouts, and deployment of phishing-resistant MFA.
- Integrity monitoring for VPN and VDI authentication components.
- Administrative tiering and network segmentation for DCs and backups.
- Controls on mass SaaS downloads and unauthorized storage uploads.
- Offline immutable backups and regular restore drills using independent credentials.
12. Facts, Inferences, and Hypotheses
Facts
- The FBI observed two FortiOS/FortiProxy authentication bypass CVEs used for initial access.
- The KNPA observed VPN credential/session capture, VDI cookie hijacking, and MFA bypass via static OTPs.
- Attackers obtained NTDS hashes using Impacket and moved laterally via SMB/RDP/SSH.
-
main.exetargeted OneDrive and SharePoint, exfiltrating dozens of terabytes in one observed incident. - Gunra performs multi-thread encryption using ChaCha20 + RSA-4096, and the standalone encryptor generates no DNS or HTTP traffic.
- Deletion of backups in both primary data centers and DR centers was confirmed in some cases.
Inferences
- Patching VPNs alone cannot remove already created accounts, cookies, OTP backdowns, or OpenSSH tunnels.
- Encryption detection happens at the final stage; mass SaaS downloads and tampering with authentication components serve as earlier points of interception.
- Organizations facing similar architectures—combining FortiGate, VDI, Hiware-like privileged access management, and M365—share the same attack surface globally.
Hypotheses
- Correlating four factors—VPN config changes, VDI file hashes, repeated identical OTP successes, and cookie reuse—may enable early detection of MFA bypasses.
- Correlating backup deletions across primary and DR environments can help distinguish between routine maintenance and ransomware preparation with high accuracy.
13. MITRE ATT&CK Mapping
High Confidence (Based on Joint Advisory Observations and Mappings)
- T1190 – Exploit Public-Facing Application
- T1133 – External Remote Services
- T1078.001 / T1078.002 – Valid Accounts
- T1105 – Ingress Tool Transfer
- T1572 – Protocol Tunneling
- T1098 – Account Manipulation
- T1021.001 / T1021.002 – RDP / SMB Windows Admin Shares
- T1003.003 – NTDS
- T1550.002 / T1550.003 – Pass the Hash / Pass the Ticket
- T1040 – Network Sniffing
- T1539 – Steal Web Session Cookie
- T1556.006 – Multi-Factor Authentication
- T1555 – Credentials from Password Stores
- T1070.003 – Clear Command History
- T1083 – File and Directory Discovery
- T1114 – Email Collection
- T1005 – Data from Local System
- T1530 – Data from Cloud Storage
- T1560 – Archive Collected Data
- T1567 / T1048 – Exfiltration Over Web Service / Alternative Protocol
- T1047 / T1059.003 – WMI / Windows Command Shell
- T1490 – Inhibit System Recovery
- T1486 – Data Encrypted for Impact
Supplementary Notes
- The joint advisory also references ATT&CK v19.1 techniques
T1678(operational timing, such as nighttime activity),T1679(encryption filtering), andT1685(clearing network access logs). If your SOC platform uses older versions, retain these as custom tags.
14. Unknowns and Additional Investigations
- Initial access methods and C2 differences among affiliates.
- Complete IOCs for static OTP values, modified file names, and VPN traffic-control modifications.
- Detailed mechanics on whether
main.exeutilizes M365 APIs, sync clients, or browser sessions. - Full execution and encryption specifications for the Linux variant.
- Current active Tor addresses, qTox IDs, and infrastructure expiration dates.
- Correlation between data successfully saved at exfiltration destinations and leak previews.
15. Impact on SOCs and General Enterprises
Architectures featuring FortiGate/FortiProxy, SSL-VPN, VDI, Active Directory, M365, privileged access management, NAS, and dual-site backups are common across global enterprises. Rather than attacking each component in isolation, Gunra leverages them as a continuous chain centered around perimeter administrator workstations.
Crucially, MFA bypasses are implemented not merely through OTP phishing, but via tampering with authentication processing files combined with session cookies. Password resets or re-registering MFA are insufficient; rebuilding VPN/VDI components and revoking tokens are necessary. SOCs should not wait for encryption alerts; instead, they must integratively monitor FortiGate configuration changes, nighttime VDIs, NTDS access, mass M365 downloads, and primary/DR backup operations.
16. Summaries by Target Audience
For SOCs
- Build cross-domain timelines spanning FortiGate → VDI → AD/Hiware → M365 → backups.
- Treat successful identical OTP logins, cookie reuse, and authentication file modifications as MFA bypasses.
- Distinguish between enumeration and successful exfiltration by verifying archive creation and SaaS/Mega transfers.
For Administrators
- Patch Fortinet CVEs and remove default/unused accounts as well as internet-facing management surfaces.
- Implement administrative tiering, integrity monitoring for VPN/VDI files, and immutable backups with independent credentials.
- During a breach, rotate not only passwords but also tokens, cookies, OTP handlers, and access-control keys.
For Users
- Immediately report unusual MFA behaviors or unexpected sessions on VPNs or VDIs.
- If ransom notes or changed file extensions appear, do not operate or reboot the device; request network isolation from the SOC.
- Do not reply to emails from attackers demanding payment; forward them to legal, management, and incident response teams.
Top comments (0)