Gunra Ransomware Exploits Fortinet FortiOS, Forti Proxy Flaws to Breach Networks
Summary: South Korean and U.S. cybersecurity and intelligence agencies warned that Gunra ransomware attacks are targeting critical infrastructure sectors worldwide, gaining initial access through flaws in internet-facing Fortinet FortiOS and FortiProxy appliances (CVE-2024-55591 and CVE-2025-24472) and then deploying the ransomware in a double extortion model combining data exfiltration and encryption. Gunra has listed 51 victims since emerging in April 2025, mostly from South Korea, Brazil, Spain, Thailand, and Hong Kong, with the majority of targets in Australia, East Asia, and Europe and only three victims reported from Canada and the U.S.
Key Takeaway: The group has been observed tampering with VDI authentication files so that a specific Gunra-designated one-time password value authenticates successfully, defeating MFA on the portal that guards internal access, and it has recruited penetration testers and ethical hackers as initial access brokers paid a share of ransom profits for enterprise network access.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Mentions
- CVE-2024-55591CVE-2025-24472
- Related
- CVE-2025-24472: Fortinet FortiOS and Forti Proxy Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 18, 2025CVE-2024-55591: Fortinet FortiOS and Forti Proxy Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Jan 14, 2025