The Challenge
In April 2025, the FBI identified the first Gunra ransomware attacks. By January 2026, Gunra had transformed into a full ransomware-as-a-service (RaaS) platform, complete with affiliate recruitment on dark web forums, a management panel, configurable ransomware builders, and structured documentation for criminal partners. The threat actors didn't just create malware, they developed a business model.
The challenge for defenders isn't just one sophisticated threat actor. It's an ecosystem where penetration testing tools and leaked source code, like the 2022 Conti leak, combine with commercial-grade affiliate programs to industrialize attacks. Gunra actors exploited CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities in FortiOS and FortiProxy, to gain initial access through VPN gateways. They used Impacket's secretsdump.py to extract password hashes from domain controllers, then moved laterally via SMB and RDP.
For one victim analyzed by the Republic of Korea's National Police Agency, the actors accessed an SSL-VPN administrative console using default credentials where account lockout controls weren't configured. They modified an unused account to bypass mandatory password changes, stole session cookies from network traffic, and planted a backdoor OTP value in the VDI authentication portal to defeat multi-factor authentication. They operated during off-hours to avoid detection, deleted logs, and exfiltrated data before encryption, classic double-extortion.
The Environment and Constraints
The joint advisory from FBI, CISA, DC3, NSA, USSS, and KNPA documented victims across healthcare, financial services, critical manufacturing, transportation, government facilities, utilities, academia, media, retail, and professional services. The geographic spread included the Americas, Europe, Middle East, Africa, and Asia-Pacific.
This cross-sector, cross-geography pattern reflects a fundamental constraint: organizations with internet-facing infrastructure and insufficient vulnerability management become targets of opportunity. The RaaS model means affiliates don't need deep technical expertise, they receive ready-made tooling and support. Your security posture competes not against a single adversary but against a marketplace of motivated criminals with turnkey attack kits.
The technical environment matters. Gunra's Windows variant enumerates all drive letters using FindFirstFileW and FindNextFileW API calls, targeting comprehensive file system encryption. A Linux variant appeared mid-2025, expanding cross-platform reach. The malware includes IsDebuggerPresent API checks to detect reverse engineering attempts and performs encryption without observable network indicators.
Your constraints: patching cycles that lag behind exploit publication, network architectures that allow lateral movement from VPN gateways to domain controllers, backup strategies that store recovery data on network-accessible storage, and authentication controls that rely on static credentials or bypassable MFA implementations.
The Approach Taken
The authoring agencies outlined a layered defense model built on three priorities:
Patch known exploited vulnerabilities in internet-facing systems. This includes VPN gateways, RDP-exposed infrastructure, and any appliance that brokers external access to internal networks. The advisory specifically called out FortiOS and FortiProxy CVEs, but the principle extends to any internet-facing asset. Your vulnerability management program must prioritize externally reachable systems, these are initial access vectors, not theoretical risks.
Implement and test offline, immutable backups. The guidance specifies backups stored in a physically separate, segmented location. "Offline" defeats ransomware that enumerates network shares. "Immutable" defeats attackers who delete or encrypt backup files before triggering the encryptor. "Physically separate" means air-gapped or logically isolated from production networks. "Test" means you've validated restoration procedures under pressure.
Segment networks to restrict lateral movement. The KNPA case study showed how attackers pivoted from a compromised workstation to the VDI authentication server, then to Active Directory, then to IT-assigned virtual desktops. Each hop exploited flat network architecture. Segmentation, enforced at the network layer with firewall rules and at the identity layer with Role-Based Access Control and Principle of Least Privilege, breaks the attack path. If your VPN gateway sits on the same network segment as your domain controllers, you've handed attackers a highway.
The advisory also mapped Gunra tactics to MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1003.003 (OS Credential Dumping: NTDS), T1021.002 (Remote Services: SMB/Windows Admin Shares), T1556.006 (Modify Authentication Process: Multi-Factor Authentication), T1539 (Steal Web Session Cookie), T1070.003 (Indicator Removal: Clear Command History). These aren't theoretical, they're observed behaviors. Your detection engineering should cover these TTPs, not just signature-based malware detection.
Results and Metrics
The advisory doesn't provide breach cost figures or recovery timelines for specific victims. What it does provide: confirmation that Gunra actors successfully bypassed MFA, exfiltrated sensitive data, encrypted production systems, and listed victims on a dedicated leak site when ransoms weren't paid. The threat actors operate a negotiation portal on Tor, assign Client IDs, and instruct victims to contact them via qTox within five to seven days. If payment doesn't occur, they sell the data.
The metric that matters: organizations with unpatched internet-facing vulnerabilities, network-accessible backups, and flat network architectures became victims. Organizations that implemented the three priority controls reduced attack surface and limited blast radius.
What They Would Do Differently
The KNPA case study reveals preventable failures. The SSL-VPN appliance had an account with default credentials and no account lockout policy. The actors exploited this to gain administrative access. The VDI authentication portal allowed session hijacking because session cookies weren't protected with sufficient entropy or expiration controls. The authentication processing files were modifiable by an attacker who gained server access, enabling the OTP bypass.
If you're conducting a post-incident review, ask these questions:
- Do we enforce account lockout policies on all authentication endpoints, including appliance admin consoles?
- Have we eliminated default credentials from every system, including legacy infrastructure?
- Do we monitor for authentication processing file modifications on critical identity systems?
- Can an attacker who compromises a workstation reach our domain controllers without crossing a firewall boundary?
- Are our backups accessible from any network-connected system, or are they truly offline?
The advisory doesn't say "they should have had a SIEM." It says they should have patched CVEs, segmented networks, and protected backups. These are architectural decisions, not tool purchases.
Takeaways for Your Team
Map your internet-facing attack surface. Every VPN gateway, firewall web interface, and RDP-exposed server is a potential initial access vector. If you can't patch within 72 hours of exploit publication, you need compensating controls, network isolation, IP allowlisting, or service shutdown.
Test your backup restoration under adversarial conditions. Schedule a tabletop exercise where the scenario assumes attackers have domain admin credentials and seven days of dwell time. Can you restore without paying ransom? If your backups live on a NAS accessible via SMB, the answer is no.
Segment privileged access paths. Your VPN gateway should not have direct network access to domain controllers. Your VDI environment should not share network segments with production file servers. Use firewall rules, VLANs, and Zero Trust Architecture principles to enforce segmentation.
Monitor for credential dumping and lateral movement. The Gunra playbook includes secretsdump.py against NTDS files and psexec.py for SMB-based lateral movement. If your Security Information and Event Management system or endpoint detection tooling doesn't alert on these behaviors, you're blind to post-compromise activity.
Enforce MFA with phishing-resistant methods. The OTP bypass in the KNPA case study shows that MFA isn't a silver bullet. FIDO2 hardware tokens or certificate-based authentication resist session hijacking and credential theft better than SMS or app-based OTPs.
The RaaS model means you're not defending against a single adversary with limited resources. You're defending against a marketplace where affiliates buy access to tested tooling, documented playbooks, and profit-sharing agreements. Your controls need to assume motivated attackers with time, persistence, and technical support. Patch, segment, and protect your backups, these are the minimum viable defense against industrialized ransomware.
