← All writing

Cybersecurity Assessment: Gunra Ransomware (AA26-222A)

· 3 min
cybersecurityransomwareincident-response

An assessment of the CISA advisory (AA26-222A) along with practical mitigation advice.

1. Threat Assessment

Gunra is a sophisticated, highly commercialized Ransomware-as-a-Service (RaaS) that leverages a double-extortion model — encrypting victim systems while also stealing data to threaten public release on their dark web leak site. Originally emerging in 2025 and built upon the leaked Conti ransomware code, Gunra has expanded significantly in 2026.

Key Characteristics:

  • Target Scope: Global scale, primarily targeting government, critical infrastructure, healthcare, financial services, and manufacturing sectors.
  • Affiliate Model: The group recruits “ethical hackers” and initial access brokers, paying them a share of the ransom to gain enterprise access.
  • Cross-Platform: While initially focused on Windows, the group has expanded to target Linux environments, enabling broader disruption.

2. Attack Vector Analysis

Based on the advisory, Gunra affiliates do not typically rely on phishing; instead, they exploit exposed edge infrastructure and identity weaknesses:

  • Edge Exploitation: Initial access is heavily reliant on exploiting internet-facing VPNs and firewalls, specifically targeting FortiOS and FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 and CVE-2025-24472).
  • Identity Compromise: Attackers target VPNs with default credentials or missing account lockout policies. They also steal session cookies to hijack active sessions.
  • MFA Bypass: In advanced intrusions, the actors modify Virtual Desktop Infrastructure (VDI) authentication files to accept a static, attacker-designated One-Time Password (OTP), allowing persistent MFA bypass.
  • Lateral Movement: Once inside, they use legitimate administrative tools like Impacket (psexec.py, smbclient.py, secretsdump.py) to extract active directory hashes (NTDS), hijack RDP sessions, and deploy OpenSSH for hidden persistence tunnels.

3. Practical Advice & Immediate Mitigations

To protect your organization against Gunra’s specific tactics, implement the following prioritized steps:

A. Secure the Perimeter (Immediate Priority)

  • Patch Edge Devices: Immediately apply vendor patches to all internet-facing firewalls and VPN appliances. Specifically, audit for and patch Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472.
  • Lock Down VPNs: Ensure that all remote access gateways have strict account lockout policies enabled after a set number of failed attempts to prevent brute-forcing.
  • Remove Default Credentials: Audit edge devices (like SSL-VPNs) to ensure no default or unused administrative accounts exist.

B. Harden Identity and Access Management (IAM)

  • Enforce Strict MFA: Require Multi-Factor Authentication for all remote access and administrative accounts.
  • Monitor Authentication Portals: Implement file integrity monitoring (FIM) on your VPN and VDI web portals. Gunra attackers modify these backend files to create “master” OTPs. FIM will alert you if an attacker tampers with authentication scripts.
  • Invalidate Stale Sessions: Configure VPNs and VDIs to enforce hard session timeouts to prevent session cookie hijacking.

C. Restrict Lateral Movement

  • Network Segmentation: Isolate critical systems (like Active Directory, backups, and hypervisors) from general user networks and VDI environments.
  • Monitor for Impacket: Because Gunra heavily relies on Impacket libraries for lateral movement, configure your EDR/SIEM to alert on anomalous use of psexec.py, smbclient.py, and secretsdump.py.
  • Restrict SMB and RDP: Disable Server Message Block (SMB) and Remote Desktop Protocol (RDP) between standard user endpoints. Only allow RDP/SMB traffic from designated administrative jump-boxes.

D. Ensure Extortion Resilience

  • Immutable Backups: Implement offline, immutable backups (backups that cannot be deleted or altered by an administrator once written). Gunra actively searches for all accessible drives (A through Z) to encrypt them; keeping backups logically or physically separated is your only guarantee of recovery without paying a ransom.
  • Data Encryption at Rest: Because Gunra threatens to leak stolen data, ensure highly sensitive information is encrypted at rest. Stealing encrypted files drastically reduces the leverage the attackers have during extortion negotiations.