Cybersecurity

Gunra Ransomware Runs on Fortinet Bugs Patched in 2025

CISA, the FBI, NSA and South Korea jointly named Gunra ransomware on August 10. It breaks in through two Fortinet flaws patched over a year ago. The real finding is patch lag, not the malware.

CybersecurityBy Servola Tech Desk2026-08-133 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Gunra Ransomware Runs on Fortinet Bugs Patched in 2025

Key takeaways

CISA, the FBI, the NSA, the U.S. Secret Service, the Department of Defense Cyber Crime Center and South Korea's National Police Agency jointly named Gunra ransomware in advisory AA26-222A on August 10, 2026, warning that its affiliates are breaching healthcare, financial, government and critical infrastructure targets through exposed VPN gateways, firewalls and RDP.
Gunra's primary entry points are CVE-2024-55591 and CVE-2025-24472, two Fortinet FortiOS and FortiProxy authentication-bypass flaws that Fortinet patched in January and February 2025 respectively - meaning every successful breach the advisory describes ran through a door that has had a fix available for well over a year.
The group, which the advisory traces to leaked Conti ransomware source code, has listed 51 victims since it emerged in April 2025, and its Linux variant can run up to 100 parallel encryption threads to encrypt terabytes of data within hours before giving victims five to seven days to pay.
For any EU or UK organisation still running unpatched FortiOS or FortiProxy on an internet-facing appliance, Gunra is not really the finding: NIS2 Article 21 requires appropriate vulnerability handling, and an 18-month gap between an available patch and an exploited appliance is difficult to defend as appropriate under any reading of that requirement.
Fortinet's installed base across European telecoms, healthcare and public-sector networks is large enough that this single patch gap represents more live attack surface than any new zero-day the same agencies are likely to disclose this quarter.

A Joint US-South Korea Advisory Names a New Extortion Gang

On August 10, 2026, CISA published advisory AA26-222A under its #StopRansomware series, co-authored with the FBI, the NSA, the U.S. Secret Service, the Department of Defense Cyber Crime Center and South Korea's National Police Agency. The advisory formally names Gunra as an active ransomware-as-a-service operation and traces its code lineage to the leaked source of the Conti ransomware family, a common ancestor for several extortion groups that have emerged since Conti's own operators dissolved the brand.

The authoring agencies describe Gunra affiliates as combining credential compromise, data theft and rapid encryption in double-extortion campaigns against healthcare systems, financial services firms, government agencies, professional services companies and nonprofits, with entry gained primarily through exposed VPN gateways, firewall appliances and RDP-accessible systems rather than through any novel exploit technique.

The Doors Gunra Walks Through Were Patched 18 Months Ago

The advisory identifies two specific vulnerabilities as Gunra's primary path into victim networks: CVE-2024-55591, an authentication-bypass flaw in Fortinet FortiOS, and CVE-2025-24472, the equivalent flaw in FortiProxy. Fortinet shipped fixes for these in January and February 2025 respectively, after both were disclosed as under active exploitation by other threat actors at the time.

That timeline matters more than the malware itself. Gunra did not need a fresh zero-day to breach 51 organisations since April 2025; it needed internet-facing Fortinet appliances that had gone eighteen months or more without the available patch. Given how widely FortiOS and FortiProxy are deployed across mid-size and large European organisations as VPN and perimeter infrastructure, an unpatched instance is not a rare finding in an external scan - it is a routine one.

9 Terabytes, 100 Threads: Inside the Encryption Playbook

Once inside, Gunra affiliates follow a now-familiar double-extortion sequence: steal data, encrypt systems, then demand payment for both a decryption key and a promise not to publish what was taken. The group's Linux variant is built for speed, supporting up to 100 parallel encryption threads and partial-file encryption using stream ciphers such as Salsa20 or ChaCha20, letting it encrypt datasets as large as 9 terabytes within a limited window rather than over days.

Victims who do not pay within five to seven days have their stolen data published on Gunra's leak site, with negotiations conducted through a Tor-based portal. The advisory's recommended defences are unglamorous by design: patch internet-facing VPN and firewall appliances, maintain offline and immutable backups, and segment networks so that a single compromised device cannot reach the rest of the environment.

Why Patch Lag, Not the Malware, Is the NIS2 Finding Here

For an EU organisation working through NIS2 Article 21's risk-management measures, or a UK operator under equivalent NCSC guidance, the actionable conclusion from this advisory is not about Gunra specifically. It is that an authentication-bypass flaw in widely deployed perimeter infrastructure, patched over a year ago and still described in an August 2026 federal advisory as an active breach vector, represents a vulnerability-management failure that predates and outlives any single ransomware brand.

The practical response is to treat this advisory as a trigger for an immediate FortiOS and FortiProxy version audit across every internet-facing appliance the organisation controls, not just the ones already flagged in existing patch-management dashboards, since it is precisely the forgotten or unmanaged appliance that a patch-lag flaw like this one is built to find.

Frequently asked questions

Is Gunra a new ransomware group, or a rebrand of an existing one?

The advisory traces Gunra's code to leaked Conti ransomware source, which several groups have built on since Conti's operators dissolved that brand, but Gunra itself has operated under its own name and leak site since it emerged in April 2025 and is treated by the authoring agencies as a distinct, active operation.

The exploited Fortinet flaws were patched over a year ago - why does this advisory matter now?

Precisely because the flaws are old. The advisory's finding is that Gunra does not need new vulnerabilities to keep breaching organisations; it only needs internet-facing appliances that were never updated after fixes shipped in January and February 2025, which is a vulnerability-management gap rather than a new technical threat.

What should an EU or UK organisation running Fortinet infrastructure do this week?

Confirm the patch level of every internet-facing FortiOS and FortiProxy instance against CVE-2024-55591 and CVE-2025-24472 specifically, not just against the latest general release, then apply the advisory's other recommendations: offline immutable backups and network segmentation, since both blunt Gunra's rapid-encryption playbook even if an appliance is later found to be compromised.

Gunra is a new name attached to an old door. The advisory's own timeline shows the fix for both entry points shipped in early 2025; the finding worth acting on is not the ransomware brand but how many internet-facing Fortinet appliances in EU and UK networks still have not been checked against those two CVEs.

GunraransomwareFortinetCISANIS2patch management

Siemens and Schneider Joined the Advisory on 22 July

CISA's PLC advisory named Rockwell in April. On 22 July it added the Siemens S7-1200 and Schneider Modicon M340 - the controllers in European plant rooms.

5 min read

Cybersecurity

Your Older Macs Needed Seven Tries to Get Patched

Apple closed 155 CVEs in macOS Tahoe 26.6 on 27 July and 87 in iOS 26.6. The update for older Macs shipped the same day, but only after seven release candidates.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles