14 mincritical
#StopRansomware: Gunra Ransomware (CVE-2024-55591, CVE-2025-24472)
Gunra is a Conti-derived ransomware-as-a-service that employs double extortion, encrypting victim data with ChaCha20 + RSA-4096 and threatening to publish exfiltrated data on a Tor-based leak site. The actors gain initial access primarily by exploiting authentication bypass vulnerabilities (CVE-2024-55591, CVE-2025-24472) in FortiOS and FortiProxy devices, then use Impacket libraries, Mimikatz, and credential dumping for lateral movement and privilege escalation. The ransomware targets both Windows and Linux environments, with the Linux variant containing a weak PRNG flaw that may allow file recovery without paying ransom.
Sens:■ Immediate
IOCs29
17ip4domain4sha2562cve1filename1file path
Detection / Hunteropenrouter
What Happened
A criminal group called Gunra is attacking organizations by breaking into their networks through security flaws in Fortinet firewall products and stealing login credentials. Once inside, they steal sensitive data, then lock up the organization's files using strong encryption and demand large ransom payments, threatening to publish the stolen data if victims do not pay. They target government agencies, hospitals, banks, manufacturers, and other critical organizations across the Americas, Europe, Middle East, Africa, and Asia-Pacific. Organizations should immediately patch the two Fortinet vulnerabilities identified in this report, ensure multi-factor authentication is enabled on all remote access services, and maintain offline backups that attackers cannot reach. If affected by the Linux variant, victims may be able to recover files without paying due to a flaw in the encryption implementation.
Key Takeaways
- Gunra is a Conti-derived ransomware-as-a-service that uses double extortion, encrypting data with ChaCha20 + RSA-4096 and threatening publication of exfiltrated data on a Tor-based leak site.
- Initial access is primarily achieved by exploiting CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities in FortiOS and FortiProxy, as well as default credentials on SSL-VPN appliances.
- Gunra actors create a malicious 'forticloud-sync' super-user account on vulnerable Fortinet devices to maintain persistent access.
- The Linux variant of Gunra uses a weak PRNG seeded with srand(time(NULL)), making encrypted files potentially recoverable without paying ransom by reconstructing keys from file timestamps.
- Gunra actors modify VDI authentication server files to accept a hardcoded OTP value, creating a persistent MFA bypass backdoor.
Affected Systems
- FortiOS firewall and SSL-VPN appliances (vulnerable to CVE-2024-55591, CVE-2025-24472)
- FortiProxy devices
- Windows operating systems
- Linux operating systems
- Virtual Desktop Infrastructure (VDI) environments
- Active Directory domain controllers
- Microsoft OneDrive and SharePoint deployments
- Network Attached Storage (NAS) systems
- Hiware system access control servers
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2024-55591 | FortiOS / FortiProxy | Critical | Authentication bypass vulnerability using an alternate path or channel that allows threat actors to create a malicious persistent super-user account on vulnerable FortiOS firewall devices. |
| CVE-2025-24472 | FortiOS / FortiProxy | Critical | Authentication bypass vulnerability using an alternate path or channel that allows threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a malicious persistent user. |
Attack Chain
- Initial Access: Gunra actors exploit CVE-2024-55591 or CVE-2025-24472 in FortiOS/FortiProxy devices to bypass authentication, or use default credentials on SSL-VPN appliances lacking account lockout controls.
- Persistence: Actors create a malicious 'forticloud-sync' super-user account on Fortinet devices, modify unused accounts to bypass password change requirements, and download OpenSSH for SSH tunneling to maintain access.
- Credential Access: Actors use secretsdump.py to dump NTDS hashes from domain controllers, steal session cookies from SSL-VPN traffic, steal symmetric encryption keys from Hiware access control servers, and modify VDI authentication files to accept a hardcoded OTP for persistent MFA bypass.
- Lateral Movement: Actors use Impacket psexec.py and smbclient.py over SMB, RDP via stolen VDI sessions, and pass-the-hash/pass-the-ticket techniques to pivot to domain controllers, VDI servers, and IT personnel desktops.
- Collection and Exfiltration: Actors collect business documents, databases, PII, and emails, use main.exe to exfiltrate OneDrive and SharePoint data, archive data with 7-Zip/WinRAR, and exfiltrate to Mega or via FileZilla FTP.
- Impact: Actors delete volume shadow copies via WMI, delete backup infrastructure data, encrypt files with ChaCha20 + RSA-4096 appending .ENCRT extension, and drop R3ADM3.txt ransom notes demanding payment via Tor portal or qTox.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: STIX XML, STIX JSON
The advisory provides IOC data in downloadable STIX XML and STIX JSON formats. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are included in the article text. The advisory includes MITRE ATT&CK technique mappings and detection guidance for network defenders.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect WMIC shadow copy deletion, Impacket tool execution, and Mimikatz activity. However, Gunra's use of native APIs, legitimate remote management tools (AnyDesk, Google Remote Desktop), and timing activity outside business hours reduces visibility. The self-contained binary with no network indicators during encryption also limits EDR network-based detection. |
| Network Visibility | Medium | Network monitoring can detect SMB lateral movement, SSH tunneling, FTP exfiltration via FileZilla, and connections to known Gunra IPs. However, the ransomware binary performs encryption without network indicators, and exfiltration to Mega uses legitimate HTTPS, making it harder to distinguish from normal traffic without DLP or cloud access controls. |
| Detection Difficulty | Moderate | Gunra uses a mix of native APIs, legitimate tools, and known exploit techniques. The IOC set is reasonably comprehensive with IPs, hashes, and domains. The use of legitimate remote management tools and cloud services for exfiltration increases difficulty, but the known CVEs and specific account creation patterns provide clear detection opportunities. |
Required Log Sources
- FortiOS/FortiProxy authentication and configuration change logs
- Windows Event Logs (Security, System, Application)
- PowerShell operational logs
- VPN/SSL-VPN appliance authentication and session logs
- VDI authentication server logs
- Active Directory domain controller logs
- Network flow data
- DNS resolution logs
- Endpoint detection and response (EDR) telemetry
- File server audit logs for mass file modification events
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for creation of a user account named 'forticloud-sync' on Fortinet devices, which indicates exploitation of CVE-2024-55591 or CVE-2025-24472. | FortiOS/FortiProxy authentication logs, device configuration change logs, user account creation events. | Initial Access / Persistence | Low — this is a specific attacker-chosen account name unlikely to appear in legitimate Fortinet deployments. |
| Consider hunting for execution of WMIC shadowcopy delete commands originating from cmd.exe, which indicates pre-encryption preparation activity. | EDR process execution logs, Windows Event Logs (Security), command-line auditing. | Impact | Low — legitimate shadow copy deletion is uncommon in production environments and typically performed by backup administrators with documented change requests. |
| Consider hunting for execution of Impacket tools (psexec.py, smbclient.py, secretsdump.py) on Windows endpoints, which indicates lateral movement and credential dumping activity. | EDR process execution logs, SMB access logs, Windows Event Log IDs 4624, 4688, network flow data on port 445. | Lateral Movement / Credential Access | Medium — Impacket tools may be used by legitimate penetration testing teams; correlate with authorized activity and external source connections. |
| Consider hunting for modifications to VDI authentication server files that introduce a hardcoded OTP value, which indicates a persistent MFA bypass backdoor. | File integrity monitoring on VDI authentication servers, web server file change logs, EDR file modification alerts. | Credential Access / Persistence | Low — authentication processing file modifications on VDI servers are rare and should be investigated as potential compromise. |
| Consider hunting for large-volume data transfers to Mega cloud storage or FTP servers using FileZilla, especially outside business hours, which indicates data exfiltration. | Network flow data, proxy logs, DNS logs, cloud access security broker (CASB) logs, firewall egress logs. | Exfiltration | Medium — legitimate use of Mega and FileZilla exists in some environments; correlate with user context, data volume, and timing patterns. |
Control Gaps
- Standard signature-based AV may miss Gunra's self-contained binary that uses native Windows APIs rather than imported functions.
- Network-based detection will not identify the encryption phase since the binary operates without network indicators.
- Legitimate remote management tools (AnyDesk, Google Remote Desktop) used by Gunra may be allowlisted or excluded from security monitoring.
- Exfiltration to Mega over HTTPS may bypass network DLP if cloud storage services are not inspected or blocked.
- MFA bypass via VDI authentication file modification would not be detected by standard authentication monitoring.
- Activity timed during late-night hours may not trigger alerts if monitoring is tuned for business-hours anomalies only.
Key Behavioral Indicators
- Creation of a 'forticloud-sync' user account on Fortinet devices with super-user privileges
- WMIC shadowcopy delete commands executed via cmd.exe on Windows endpoints
- Files renamed with .ENCRT or .CRYPT extensions appearing in bulk across file systems
- R3ADM3.txt ransom notes appearing in multiple directories simultaneously
- Execution of secretsdump.py or other Impacket libraries on domain controllers
- Modifications to VDI authentication server files outside of planned maintenance windows
- Large-volume outbound transfers to Mega or FTP servers during off-hours
- Execution of main.exe with SHA256 matching known Gunra exfiltration tool hashes
- SSH tunneling established from SSL-VPN appliance to external IP addresses
- IsDebuggerPresent API calls in executed binaries indicating anti-debugging checks
False Positive Assessment
Low — the IOCs are specific to Gunra infrastructure and malware samples. The 'forticloud-sync' account name and .ENCRT/.CRYPT file extensions are distinctive. However, the legitimate tools Gunra abuses (7-Zip, FileZilla, RClone, AnyDesk, Impacket) may generate false positives if used by authorized personnel; correlate tool usage with user context, timing, and source network.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize patching CVE-2024-55591 and CVE-2025-24472 on all internet-facing FortiOS and FortiProxy devices immediately.
- Consider auditing all Fortinet devices for the presence of a 'forticloud-sync' user account or any unrecognized super-user accounts, and remove them if found.
- Consider reviewing SSL-VPN appliance configurations for default credentials, unused accounts, and disabled account lockout policies, and remediate any findings.
- Consider blocking or investigating the IP addresses and domains listed in the advisory IOC tables, verifying against your environment before taking network-level action.
- If you suspect compromise, consider isolating affected hosts and preserving forensic artifacts including encrypted files, ransom notes, and system logs before remediation.
Infrastructure Hardening
- Consider implementing network segmentation to restrict lateral movement from initially compromised devices to critical systems such as domain controllers and backup infrastructure.
- Evaluate whether your backup strategy includes offline, immutable copies stored in a physically separate location that attackers cannot reach or delete.
- Consider enforcing MFA on all remote access services, VPNs, and administrative interfaces, and review VDI authentication server files for unauthorized modifications.
- Consider deploying file integrity monitoring on VDI authentication servers to detect modifications to authentication processing files.
- Evaluate whether your egress filtering blocks or monitors connections to cloud file-sharing services like Mega and FTP servers used for data exfiltration.
User Protection
- Consider disabling command-line and scripting permissions for non-administrative users where feasible to limit privilege escalation and lateral movement tooling.
- Consider deploying EDR with behavioral detection capabilities to identify Impacket execution, Mimikatz activity, and native API abuse patterns.
- Evaluate whether your endpoint controls can detect and block the known Gunra file hashes (main.exe, cryptor.exe, msmp.exe) and the R3ADM3.txt ransom note.
- Consider monitoring for bulk file rename events with .ENCRT or .CRYPT extensions as an early indicator of ransomware execution.
Security Awareness
- Consider incorporating awareness of late-night or early-morning anomalous activity into your SOC monitoring procedures, since Gunra actors time operations to avoid detection.
- Consider training IT staff to report unauthorized SSH tunneling or remote management tool installations on systems they administer.
- Consider reviewing existing awareness programs to ensure staff understand the risk of responding to ransom negotiation emails directly and know to escalate such communications to security teams.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping36 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Ips:
23[.]239[.]119[.]3- Gunra ransomware infrastructure IP, observed July-November 2025.23[.]239[.]119[.]4- Gunra ransomware infrastructure IP, observed July-November 2025.23[.]239[.]119[.]5- Gunra ransomware infrastructure IP, observed July-November 2025.23[.]239[.]119[.]6- Gunra ransomware infrastructure IP, observed July-November 2025.86[.]54[.]28[.]216- Gunra ransomware infrastructure IP, observed June-July 2025.103[.]125[.]234[.]14- Gunra ransomware infrastructure IP, observed November-December 2025.70[.]36[.]99[.]82- Gunra ransomware infrastructure IP, observed November-December 2025.211[.]21[.]210[.]181- Gunra ransomware infrastructure IP, observed November-December 2025.123[.]184[.]143[.]105- Gunra ransomware infrastructure IP, observed November-December 2025.182[.]204[.]21[.]240- Gunra ransomware infrastructure IP, observed November-December 2025.182[.]204[.]16[.]112- Gunra ransomware infrastructure IP, observed November-December 2025.123[.]244[.]187[.]144- Gunra ransomware infrastructure IP, observed November-December 2025.182[.]204[.]39[.]118- Gunra ransomware infrastructure IP, observed November-December 2025.67[.]43[.]53[.]10- Gunra ransomware infrastructure IP, observed November-December 2025.123[.]246[.]37[.]108- Gunra ransomware infrastructure IP, observed November-December 2025.
- Domains:
nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onion- Additional Tor-based Gunra infrastructure address, observed January 2026.
- File Paths:
C:\Windows\System32\wbem\WMIC.exe- Native Windows WMI utility invoked by Gunra to delete volume shadow copies prior to encryption.
- Command Lines:
- Purpose: Delete volume shadow copies to inhibit system recovery before encryption | Tools:
cmd.exe,wmic.exe| Stage: Impact
- Purpose: Delete volume shadow copies to inhibit system recovery before encryption | Tools:
- Other:
forticloud-sync- Malicious Fortinet user account created by Gunra actors via CVE-2024-55591/CVE-2025-24472 exploitation, granted super-user privileges with a hard-coded password.[email protected]- Email address used by Gunra actors for ransom negotiation communications.[email protected]- Email address used by Gunra actors for ransom negotiation communications.[email protected]- Email address used by Gunra actors for ransom negotiation communications.[email protected]- Email address used by Gunra actors for ransom negotiation communications.2507312EC10BB44ED9DAA04E3C5C27E8C13154649B1A02E73ACFAE1681EE0208D05133A8FB22- qTox ID associated with Gunra ransomware actors for encrypted communication.0FE87CED0C611AE97E049C64288557F49E8271E91399E849328B078DA789A573031783235BEF- qTox ID associated with Gunra ransomware actors for encrypted communication.47829AF1C943D4C296C910706923AS199BDA4995B076ED9A9016F7DEF161D445DF00F13E6900- qTox ID associated with Gunra ransomware actors for encrypted communication.9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47- qTox ID associated with Gunra ransomware actors for encrypted communication..ENCRT- File extension appended to files encrypted by the Gunra Windows ransomware binary..CRYPT- File extension appended to files encrypted by an earlier Gunra sample from July 2025..GNRA- File extension appended to files encrypted by the Gunra Linux ELF ransomware variant.
Showing defanged values
- cveCVE-2024-55591Authentication bypass vulnerability using an alternate path or channel that allows threat actors to create a malicious persistent super-user account on vulnerable FortiOS firewall devices.
- cveCVE-2025-24472Authentication bypass vulnerability using an alternate path or channel that allows threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices to create a malicious persistent user.
- domaindatapub[.]newsClearnet mirror of Gunra's Tor-based data leak site, operational June-July 2025 for publishing victim data.
- domaingunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad[.]onionOriginal Tor-based Gunra data leak site and negotiation portal, active April 2025 to February 2026.
- domainlgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd[.]onionCurrent Tor-based Gunra data leak site, active from March 2026 onward after migration from previous onion address.
- domainnsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd[.]onionAdditional Tor-based Gunra infrastructure address, observed January 2026.
- filenameR3ADM3.txtStatic ransom note filename written by Gunra ransomware to every encrypted directory, instructing victims to contact actors via Tor portal or qTox.
- file_pathC:\Windows\System32\wbem\WMIC.exeNative Windows WMI utility invoked by Gunra to delete volume shadow copies prior to encryption.
- ip103[.]125[.]234[.]14Gunra ransomware infrastructure IP, observed November-December 2025.
- ip123[.]184[.]143[.]105Gunra ransomware infrastructure IP, observed November-December 2025.
- ip123[.]244[.]187[.]144Gunra ransomware infrastructure IP, observed November-December 2025.
- ip123[.]246[.]37[.]108Gunra ransomware infrastructure IP, observed November-December 2025.
- ip182[.]204[.]16[.]112Gunra ransomware infrastructure IP, observed November-December 2025.
- ip182[.]204[.]21[.]240Gunra ransomware infrastructure IP, observed November-December 2025.
- ip182[.]204[.]39[.]118Gunra ransomware infrastructure IP, observed November-December 2025.
- ip211[.]21[.]210[.]181Gunra ransomware infrastructure IP, observed November-December 2025.
- ip23[.]239[.]119[.]2Gunra ransomware infrastructure IP address, observed July 2025 through November 2025.
- ip23[.]239[.]119[.]3Gunra ransomware infrastructure IP, observed July-November 2025.
- ip23[.]239[.]119[.]4Gunra ransomware infrastructure IP, observed July-November 2025.
- ip23[.]239[.]119[.]5Gunra ransomware infrastructure IP, observed July-November 2025.
- ip23[.]239[.]119[.]6Gunra ransomware infrastructure IP, observed July-November 2025.
- ip67[.]43[.]53[.]10Gunra ransomware infrastructure IP, observed November-December 2025.
- ip70[.]36[.]99[.]82Gunra ransomware infrastructure IP, observed November-December 2025.
- ip86[.]54[.]28[.]216Gunra ransomware infrastructure IP, observed June-July 2025.
- ip91[.]201[.]66[.]146Gunra ransomware infrastructure IP address, observed November to December 2025.
- sha2562dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e2751SHA256 hash of main.exe, a Gunra tool used to exfiltrate data from Microsoft OneDrive and SharePoint.
- sha256834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d1SHA256 hash of a second variant of main.exe, a Gunra tool used to exfiltrate data from Microsoft OneDrive and SharePoint.
- sha25691f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0SHA256 hash of cryptor.exe, a Gunra malicious executable used in ransomware operations.
- sha256a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9SHA256 hash of msmp.exe, a Gunra malicious executable used in ransomware operations.
Related
Stay currentSubscribe via RSS