CISA Urges Organizations to Patch Exposed VPNs and Segment Networks Against Gunra Ransomware

CISA and international law-enforcement partners have issued a joint #StopRansomware advisory warning that Gunra ransomware affiliates are exploiting exposed edge infrastructure, including VPN gateways, firewall appliances and RDP-accessible systems, to breach enterprise networks.

The advisory positions Gunra as an increasingly organized ransomware-as-a-service operation whose affiliates combine data theft, credential compromise and rapid encryption to pressure victims into payment.

The group uses a conventional but damaging double-extortion model: attackers exfiltrate sensitive corporate data before encrypting files, then threaten to publish or sell the material through a Tor-hosted data-leak site if negotiations fail.

Its victim base now spans healthcare, finance, manufacturing, transport, government, utilities, education, retail and professional services across several regions.

The immediate defensive priority is remediation of internet-facing systems. Investigators observed Gunra operators exploiting FortiOS and FortiProxy authentication-bypass flaws tracked as CVE-2024-55591 and CVE-2025-24472.

Korean authorities also reported exploitation of credential-exposure and SSH access-control weaknesses affecting public-facing VPN gateways.

Organizations should therefore identify every externally reachable VPN, firewall, RDP service and remote-management interface, apply vendor fixes urgently, revoke potentially exposed credentials and eliminate default or dormant administrative accounts.

Gunra First observed by the FBI in April 2025, believed to be derived from the leaked Conti ransomware source code and began operating a formal affiliate program in early 2026.

Gunra Ransomware attack

Gunra’s intrusion tradecraft shows why patching alone is insufficient. In one observed compromise, actors accessed an SSL-VPN administrative account protected by default credentials without account-lockout controls.

They then modified a corporate VDI portal’s authentication processing to accept an attacker-controlled one-time password, effectively bypassing MFA.

Elsewhere, stolen session data enabled VDI access and RDP pivoting toward Active Directory, authentication servers and IT administrator desktops.

These incidents demonstrate that MFA must be backed by file-integrity monitoring, conditional access controls, privileged-account separation and alerting on changes to VPN and identity infrastructure.

After entry, affiliates use familiar dual-use tooling rather than exclusively bespoke malware. Impacket components such as psexec.py, smbclient.py and secretsdump.py support SMB-based movement and NTDS credential extraction.

The actors have also deployed OpenSSH tunnels, 7-Zip, Rclone, FileZilla and remote-access tools while collecting SharePoint, OneDrive, database and email data.

Defenders should investigate suspicious administrative use of these utilities in context, particularly alongside abnormal archive creation, outbound cloud-storage transfers, authentication anomalies and late-night reconnaissance activity.

The Gunra encryptor is designed for high-impact operations. It enumerates files across available drive letters, targets business data while avoiding many operating-system files, and uses multi-threaded ChaCha20 plus RSA-4096 encryption.

Encrypted data commonly receives the .ENCRT extension, while ransom notes named R3ADM3.txt are written into affected directories.

Actors have also deleted Windows shadow copies via WMI and, in at least one case, destroyed backup data at both primary and disaster-recovery locations.

CISA’s central recommendation is to treat segmentation as a containment control, not a compliance exercise. Separate user workstations, VDI, identity services, backup platforms, management networks and production workloads with tightly enforced access paths.

Deny unnecessary SMB and RDP traffic, restrict administrative access to dedicated hardened systems and ensure backup infrastructure cannot be reached using ordinary domain credentials.

Offline, immutable backups should be tested regularly in a physically separate segment to prove recovery is possible without negotiating with attackers.

Security teams should also import the advisory’s STIX indicators into detection platforms and map hunt activity to the MITRE ATT&CK Enterprise framework.

The full CISA AA26-222A advisory and broader StopRansomware resources provide technical detection guidance and incident-response actions for organizations facing this expanding threat.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide