/
← Voltar ao feed
high healthcare financial services insurance manufacturing construction transportation logistics government utilities academia media communications retail professional services nonprofit

CISA and FBI #StopRansomware advisory on Gunra, a Conti-derived RaaS exploiting Fortinet and VPN flaws for double extortion

1 fonte(s) · 1 atualização(ões) · publicado 05/08/2026 09:27 · coletado há 4 dias

The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recruits penetration testers as initial access brokers. Victims on its leak site span healthcare, financial services, critical manufacturing, transportation, government and professional services across the Americas, Europe, the Middle East, Africa and Asia-Pacific. Ransom demands reportedly start at over tens of millions of US dollars, and exfiltrated data has reached tens of terabytes.

Detalhes técnicos

  • Initial access: exploitation of internet-facing firewall and VPN appliances [T1190], specifically CVE-2024-55591 and CVE-2025-24472 (FortiOS/FortiProxy authentication bypass). KNPA also saw default credentials without lockout on an SSL-VPN admin account, plus credential-exposure and SSH access-control flaws in VPN gateways.
  • Lateral movement and persistence: Impacket psexec.py and smbclient.py over SMB, RDP into VDI environments, OpenSSH tunneling, and modification of a dormant VPN account to bypass the forced password change.
  • Credential theft: secretsdump.py against domain controllers (NTDS), pass-the-hash and pass-the-ticket, SSL-VPN traffic manipulation to capture credentials and session cookies, and tampering with VDI authentication files to accept a fixed OTP, which bypasses MFA. The actors also stole a symmetric key from a Hiware access control server to decrypt enterprise server passwords.
  • Defense evasion: log deletion, clearing command history, activity mostly between 10:00 p.m. and 06:00 a.m., and an IsDebuggerPresent anti-debugging check in the binary.
  • Exfiltration: main.exe pulls data from OneDrive and SharePoint; archives are made with 7-Zip and sent to Mega, with RClone and FileZilla also seen.
  • Impact: ChaCha20 + RSA-4096 encryption with Windows and Linux builds. Encrypted files get the .ENCRT extension (.CRYPT in a July 2025 sample, .GNRA on Linux ELF) and a R3ADM3.txt ransom note is dropped. Volume shadow copies are deleted via WMIC, and backups at the primary and DR data centers were destroyed in one case. Negotiation runs through a Tor portal or qTox within 5-7 days.
  • Decryption weakness: as of March 2026, researchers found the Linux variant's keys use a weak PRNG seeded with srand(time(NULL)), so keys may be reconstructible from file timestamps.

Remediação

  • Prioritize patching known exploited vulnerabilities on internet-facing systems, especially VPN gateways and RDP-exposed infrastructure.
  • Keep tested offline, immutable backups in a physically separate, segmented location.
  • Segment networks to restrict lateral movement.
  • If compromised, isolate hosts, preserve encrypted files, timestamps, ransom notes and logs (for Linux key recovery), hunt in edge device logs, disable actor-controlled accounts, secure privileged accounts, and report to the FBI.

Linha do tempo

  1. cisa.gov ↗ · pub. 05/08/2026 09:27 · coletado 19/10 18:37 primeiro registro

    CISA and FBI #StopRansomware advisory on Gunra, a Conti-derived RaaS exploiting Fortinet and VPN flaws for double extortion

    ler a análise desta fonte

    The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recruits penetration testers as initial access brokers. Victims on its leak site span healthcare, financial services, critical manufacturing, transportation, government and professional services across the Americas, Europe, the Middle East, Africa and Asia-Pacific. Ransom demands reportedly start at over tens of millions of US dollars, and exfiltrated data has reached tens of terabytes.

    Technical Details

    • Initial access: exploitation of internet-facing firewall and VPN appliances [T1190], specifically CVE-2024-55591 and CVE-2025-24472 (FortiOS/FortiProxy authentication bypass). KNPA also saw default credentials without lockout on an SSL-VPN admin account, plus credential-exposure and SSH access-control flaws in VPN gateways.
    • Lateral movement and persistence: Impacket psexec.py and smbclient.py over SMB, RDP into VDI environments, OpenSSH tunneling, and modification of a dormant VPN account to bypass the forced password change.
    • Credential theft: secretsdump.py against domain controllers (NTDS), pass-the-hash and pass-the-ticket, SSL-VPN traffic manipulation to capture credentials and session cookies, and tampering with VDI authentication files to accept a fixed OTP, which bypasses MFA. The actors also stole a symmetric key from a Hiware access control server to decrypt enterprise server passwords.
    • Defense evasion: log deletion, clearing command history, activity mostly between 10:00 p.m. and 06:00 a.m., and an IsDebuggerPresent anti-debugging check in the binary.
    • Exfiltration: main.exe pulls data from OneDrive and SharePoint; archives are made with 7-Zip and sent to Mega, with RClone and FileZilla also seen.
    • Impact: ChaCha20 + RSA-4096 encryption with Windows and Linux builds. Encrypted files get the .ENCRT extension (.CRYPT in a July 2025 sample, .GNRA on Linux ELF) and a R3ADM3.txt ransom note is dropped. Volume shadow copies are deleted via WMIC, and backups at the primary and DR data centers were destroyed in one case. Negotiation runs through a Tor portal or qTox within 5-7 days.
    • Decryption weakness: as of March 2026, researchers found the Linux variant's keys use a weak PRNG seeded with srand(time(NULL)), so keys may be reconstructible from file timestamps.

    Remediation

    • Prioritize patching known exploited vulnerabilities on internet-facing systems, especially VPN gateways and RDP-exposed infrastructure.
    • Keep tested offline, immutable backups in a physically separate, segmented location.
    • Segment networks to restrict lateral movement.
    • If compromised, isolate hosts, preserve encrypted files, timestamps, ransom notes and logs (for Linux key recovery), hunt in edge device logs, disable actor-controlled accounts, secure privileged accounts, and report to the FBI.