Roberto Schmidt/Getty Images
A joint advisory published Monday by six government agencies — the FBI, the Cybersecurity and Infrastructure Security Agency, the Department of Defense Cyber Crime Center, the National Security Agency, the U.S. Secret Service, and South Korea’s National Police Agency — confirmed that a ransomware operation called Gunra has been defeating enterprise multi-factor authentication not by tricking users into approving fraudulent login attempts, but by directly modifying the authentication server itself, so that a code chosen by the attackers always works. For organizations that detected a Gunra attack on Linux systems, the CISA advisory AA26-222A disclosed a second finding with immediate financial stakes: a flaw in the way the Linux variant generates its encryption keys means that victims who preserved their encrypted files may be able to reconstruct the decryption keys from timestamps alone — without paying a ransom that the FBI observed starting at tens of millions of dollars.
The advisory, designated AA26-222A and part of CISA’s ongoing #StopRansomware initiative, is the first joint U.S.-South Korea warning focused specifically on Gunra, which first appeared in April 2025 as a double-extortion ransomware variant derived from the leaked Conti ransomware source code. By January 2026, the group had formalized into a ransomware-as-a-service operation, advertising a management panel, configurable ransomware builder, and cross-platform payloads on dark web forums. More than 50 victims across the Americas, Europe, the Middle East, Africa, and the Asia-Pacific now appear on the group’s dedicated dark web leak site, according to Ransomware.Live tracking data.
“Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations,” said Chris Butera, acting executive assistant director for cybersecurity at CISA, in a statement reported by reporting by The Record.
Why MFA Alone Cannot Stop Gunra
Most ransomware groups defeat multi-factor authentication through social engineering — phishing for credentials, exploiting MFA fatigue, or SIM-swapping phone numbers to intercept one-time codes. Gunra used a different category of technique, one that requires no victim participation at all.
In at least one documented incident, Gunra actors who had reached a victim’s internal network modified authentication processing files on the corporate virtual desktop infrastructure authentication portal server so that a specific attacker-chosen one-time password value would always succeed when entered. The result was a persistent backdoor that bypassed multi-factor authentication — and that an organization monitoring only its identity provider logs, its authenticator app alerts, or its hardware token issuances would have no way of detecting, because from those systems’ perspective, every authentication looked legitimate. The full advisory technical details catalogues this technique under MITRE ATT&CK technique T1556.006 (Modify Authentication Process: Multi-Factor Authentication).
The implication for defenders is categorical: MFA is not a terminal defense if the server that processes authentication decisions can be reached and modified. Integrity monitoring of VPN authentication processing files — not just audit logs of who authenticated, but verification that authentication logic itself has not changed — is a required defensive layer that most enterprise security checklists do not include.
The authentication file modification was not Gunra’s only credential technique. In a separate documented case, the group manipulated a victim SSL-VPN appliance’s network traffic controls to intercept credentials and session cookies from users authenticating to the same VDI portal, then used those stolen session cookies to impersonate legitimate employees on the internal network. In a third documented technique, Gunra actors accessed a Hiware system access control server via a compromised virtual desktop, stole a symmetric encryption key stored on that server, and used it to decrypt passwords for every enterprise server account in the database. All three techniques are documented in the advisory.
Fortinet Firewall Flaws Are the Entry Point
All of the credential theft and authentication manipulation described above assumes the attackers are already inside the victim’s network. They got there through two authentication bypass vulnerabilities in Fortinet FortiOS and FortiProxy products — the firewalls and SSL-VPN gateways that many organizations use as the perimeter entry point for remote employees.
CVE-2024-55591 allows an unauthenticated attacker to send crafted requests to a FortiOS Node.js websocket module and obtain super-administrator privileges without any valid credentials. CVE-2025-24472 uses a different pathway — crafted requests to the Cluster Synchronization Framework proxy — to achieve the same result on the same product lines, as as BleepingComputer later reported. Both vulnerabilities allow an attacker who exploits them to create a new persistent administrative account on the targeted device; the advisory identifies that account’s username as “forticloud-sync” with a hardcoded password and super-user privileges, a signature defenders can use to determine whether their Fortinet devices have been compromised.
Patches for both CVEs exist and were released by Fortinet in January and February 2025, respectively. Both CVEs are in CISA’s Known Exploited Vulnerabilities catalog, meaning federal agencies were already under a binding directive to patch them. Gunra’s continued ability to exploit them in 2026 indicates that a significant portion of the exposed Fortinet device population remains unpatched more than a year after the fixes became available.
How the Attack Chain Unfolds
Once inside a victim network through the Fortinet vulnerability, Gunra operators follow a documented playbook. They conduct reconnaissance during late-night and early-morning hours — typically 10 p.m. to 6 a.m. local time — to avoid detection by active security staff. They delete system and network logs and clear command history to remove evidence of their presence. They move laterally through networks using Impacket tools — specifically the psexec.py, smbclient.py, and secretsdump.py utilities — to traverse systems via the SMB protocol, extract password hashes from Active Directory domain controllers, and execute pass-the-hash and pass-the-ticket attacks to reach privileged systems. The full attack pattern is detailed in the advisory.
Data collection and exfiltration precede encryption. Gunra actors deployed a custom tool, catalogued by the FBI as main.exe, specifically designed to harvest files from Microsoft OneDrive and SharePoint environments. The stolen data is compressed using 7-Zip and WinRAR, then exfiltrated via RClone and FileZilla to the file-sharing platform Mega; in at least one documented case, the volume of exfiltrated data reached tens of terabytes. After exfiltration, the group deletes volume shadow copies using Windows Management Instrumentation commands — eliminating the primary on-system backup path — and in at least one incident deleted backup data at both the primary data center and the disaster recovery facility before deploying the encryptor. All steps are confirmed in the CISA advisory.
The Encryption Mechanism — and the Flaw Victims Need to Know About
Gunra’s Windows encryptor uses ChaCha20 stream cipher encryption combined with RSA-4096 key protection, deployed across a multi-threaded architecture that encrypts multiple files simultaneously to maximize speed. Encrypted Windows files receive the .ENCRT extension; a ransom note named R3ADM3.txt appears in every affected directory directing victims to a Tor-based negotiation portal or the encrypted messaging application qTox, typically with a five-to-seven-day payment window. The FBI observed Gunra actors starting negotiations at arbitrarily high ransom amounts — over tens of millions of dollars — and separately attempting to contact company management staff directly via email, an approach that met “with limited success,” per the CISA advisory findings.
The Linux variant is different in one critical respect. The Linux encryptor, which appends the .GNRA extension to files it locks, uses a pseudorandom number generator seeded with a call to srand(time(NULL)) — meaning the seed is the system clock time in seconds at the moment encryption began. Researchers at Breakglass Intelligence identified this weakness in March 2026, describing it as a “catastrophic cryptographic weakness,” because the system clock time at encryption is encoded in the timestamps of the encrypted files themselves. If the seed is known, the encryption key sequence can be mathematically reconstructed, which means the files can be decrypted without the attacker’s private RSA key — and without paying the ransom.
The advisory’s guidance to any organization that detects a Gunra Linux compromise is consequently specific: do not reboot affected systems, do not wipe drives, and do not overwrite encrypted files. Preserve the encrypted files, their file timestamps, any ransom notes, and relevant system logs. File timestamps are the evidence that makes key reconstruction possible; destroying them destroys the path to free recovery, per CISA’s incident response instructions.
A Growing Threat Against Critical Infrastructure
The Gunra advisory arrives against a backdrop of accelerating ransomware pressure on industrial and critical-infrastructure organizations. Dragos, a cybersecurity firm specializing in operational technology environments, identified 1,140 ransomware incidents affecting industrial organizations worldwide during the second quarter of 2026 — a 12% increase over the 1,020 incidents Dragos documented in Q1 — according to Dragos’s Q2 2026 ransomware analysis. Gunra was attributed to at least four industrial attacks in Q2 2026, after eight in Q1 — suggesting an accelerating operational tempo, as reported by reporting by The Record.
Gunra’s victims span healthcare, financial services, critical manufacturing, transportation, government services, utilities, academia, media, retail, and professional services — what CISA classifies as a cross-sector threat. The group operates a dedicated leak site on the Tor network that threatens to publish or sell stolen data if victims do not pay, and maintains a clearnet mirror that previously operated at the domain datapub.news. It recruits penetration testers and ethical hackers as initial access brokers, offering a share of ransom profits in exchange for providing footholds inside victim organizations, according to the full advisory technical details.
Researchers have separately noted infrastructure overlaps between tools used by North Korea’s Lazarus Group and some of Gunra’s operations targeting South Korean organizations, though the joint advisory stops short of formally attributing Gunra activity to any nation-state.
How to Defend Against Gunra Now
The advisory’s priority recommendations, in descending order of urgency:
Apply patches for CVE-2024-55591 and CVE-2025-24472 immediately on all internet-facing FortiOS and FortiProxy devices, and audit any Fortinet device for the presence of the forticloud-sync user account with super-admin privileges and a hardcoded password.
Verify the integrity of authentication processing files on SSL-VPN and VDI authentication servers. Standard MFA deployment does not protect against an attacker who modifies the server-side authentication logic itself; detecting this requires file-integrity monitoring on authentication processing components.
Enforce network segmentation to limit lateral movement if perimeter devices are compromised, and remove default credentials from all VPN administrative interfaces.
Maintain offline and immutable backups stored in a physically separate, segmented location. Gunra’s documented pattern of deleting both primary and disaster-recovery backups before encryption makes network-accessible backups effectively useless as a recovery path.
Apply IP addresses, domains, file hashes, email addresses, and qTox IDs published in the AA26-222A indicators of compromise as indicators of compromise to detection tools and SIEM rules. The complete list includes four Proton Mail addresses, four qTox IDs, multiple Tor .onion addresses, and SHA256 hashes for the main.exe OneDrive/SharePoint exfiltration tool and the Gunra encryptor binary.
For organizations that detect a Linux compromise specifically: preserve all encrypted .GNRA files and their timestamps before doing anything else. Key reconstruction depends on timestamp integrity. Contact CISA or the FBI before beginning any remediation that would modify file timestamps or overwrite encrypted data.
Frequently Asked Questions
How does Gunra bypass multi-factor authentication if I’ve already set up MFA on all my systems?
Gunra used a technique that operates at the authentication server level, not the user level. In a documented case, the attackers reached a corporate VDI authentication portal server and modified its authentication processing files so that a specific Gunra-controlled one-time password value always succeeded. This is catalogued under MITRE ATT&CK technique T1556.006. From the perspective of your authenticator app, your hardware token, or your identity provider, nothing unusual happened — because the authentication code you enter never reaches a compromised check. Defending against this requires file-integrity monitoring on authentication server components, not just monitoring of who authenticated, or alerting on unusual login locations.
If Gunra already hit our Linux servers, can we recover files without paying the ransom?
Possibly — but only if you act immediately and do not wipe or reboot affected systems. As of March 2026, Breakglass Intelligence identified that Gunra’s Linux variant seeds its encryption key generator with the system clock time in seconds, using the C function srand(time(NULL)). Because that seed value is encoded in the timestamps of the encrypted files, researchers may be able to mathematically reconstruct the decryption key from those timestamps alone. The CISA advisory explicitly instructs organizations to preserve encrypted files, file timestamps, ransom notes, and system logs before taking any other action. Once timestamps are destroyed — by rebooting, by overwriting files, or by wiping the system — the recovery path closes.
What makes Gunra different from other Conti-derived ransomware groups?
Gunra’s most documented differentiating technique is the authentication-file modification that defeats MFA without requiring any victim interaction. Most Conti successor groups — Akira, CACTUS, BlackByte, Royal — use credential-dumping and pass-the-hash techniques for lateral movement, but their MFA bypass methods generally rely on social engineering or session token theft. Gunra’s documented use of server-side authentication modification (T1556.006) combined with network traffic sniffing on SSL-VPN devices and symmetric key theft from an access control server represents a credential-access capability that goes deeper into authentication infrastructure than most Conti-lineage groups have documented, according to the joint advisory.
Which sectors and countries are most at risk from Gunra?
Healthcare and financial services organizations appear most frequently in the advisory’s sector framing, reflecting the industries where ransom pressure — data sensitivity plus downtime cost — is highest. South Korea, Brazil, Spain, Thailand, Hong Kong, Japan, Egypt, and the United States have all had confirmed victims, per ransomware tracking platform Ransomware.Live, as reported by The Hacker News. Any organization running internet-exposed Fortinet FortiOS or FortiProxy appliances and using VDI infrastructure with SSL-VPN authentication portals is a candidate target regardless of sector, given Gunra’s documented entry vector. The advisory designates the full scope as government, critical infrastructure, and a broad list of additional sectors spanning utilities, academia, media, retail, and professional services.
Click Here For The Original Source.
