Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2025-24472 | 8.1 | 7.1% | ✅ listed | available | 75.08 (High) |
| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |
Operation Double Barrel: State-Sponsored Actor Linked to Gunra Ransomware
AhnLab ASEC and four Korean government agencies — the National Intelligence Service, National Police Agency, Korea Internet & Security Agency, and Financial Supervisory Service — jointly published a technical advisory on July 30, 2026, titled “Operation Double Barrel.” The advisory links a state-sponsored threat actor to the Gunra ransomware group through shared techniques, tools, and infrastructure.
The state-sponsored actor has been continuously distributing malware by exploiting vulnerabilities in two Korean financial security products, “Financial Security Software A” and “Financial Security Software I,” since 2025. The attacks use watering hole pages to deliver the initial payload, which then deploys a backdoor suite consisting of Struggle (SIGNBT 3.0), Brandoor (COPPERHEDGE), a privilege escalation tool, and a dropper.
AhnLab confirmed the relationship to Gunra by comparing the state actor’s attack cases against Gunra ransomware deployments. The two share the same watering hole page, exploit the same Financial Security Software A vulnerability, and reuse SSH key fingerprints and network infrastructure for download and reverse tunneling. The state actor’s goal is persistent access and data collection, while Gunra’s is file encryption and exfiltration — but the commonalities suggest they either shared components or collaborated directly during the campaign.
The Fortinet Flaws: CVE-2024-55591 and CVE-2025-24472
Gunra’s initial access relies on two Fortinet authentication bypass flaws that let a remote, unauthenticated attacker grab super-admin privileges on FortiOS and FortiProxy appliances. Both are CWE-288 — an alternate path or channel that skips the normal auth check — and both are in CISA’s Known Exploited Vulnerabilities catalog.
CVE-2024-55591 is the workhorse. It scores CVSS 9.8 (Critical) and carries an EPSS score of 98.3% at the 100th percentile, meaning it’s been exploited in the wild with near-universal confidence. FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 plus 7.2.0 through 7.2.12 are affected. The PRS risk rating puts it at 89.88, which is Critical.
CVE-2025-24472 is the follow-up. It’s CVSS 8.1 (High) with an EPSS of 7.1% at the 94th percentile. Same CWE-288, same FortiOS 7.0.0–7.0.16 and FortiProxy 7.2.0–7.2.12 range, plus FortiOS 7.0.0–7.0.19. PRS rates it at 75.08 (High). CISA added it to KEV about a month after Fortinet disclosed it in February 2025, following ransomware attacks that weaponized the flaw.
Both CVEs let the attacker send crafted requests to the appliance and come back as super-admin. That’s how Gunra gets in, creates the persistent account, and then runs the rest of the chain.
How the State-Sponsored Actor Distributes Malware
The state-sponsored actor delivers its payload through watering hole attacks, exploiting two Korean financial security products: “Financial Security Software A” and “Financial Security Software I.” The victim visits a crafted page, the exploit fires, and the initial payload lands in memory. From there, the backdoor suite deploys in sequence: Struggle (SIGNBT 3.0) establishes the first backdoor, Brandoor (COPPERHEDGE) follows as the second, a privilege escalation tool runs to gain SYSTEM, and the dropper stages the final components. All four components have been confirmed in watering hole attacks since 2025, with the same Financial Security Software A vulnerability exploited across the campaign. The state actor’s goal is persistent access and data collection; Gunra’s is file encryption and exfiltration, but the shared watering hole page, same exploit, and reused SSH key fingerprints and network infrastructure for download and reverse tunneling tie the two together.
The Gunra Ransomware Group
Gunra is a ransomware-as-a-service family built on the leaked Conti source code from 2022. The group first appeared in April 2025 on Windows, with a Linux variant following in July 2025. In January 2026, the operators opened a formal RaaS affiliate program on dark web forums, letting financially motivated buyers pick file extensions, set per-file encryption depth, and write key material to separate keystore files. The FBI has also seen the group operate under the alias “Golden Community.”
The encryption scheme is ChaCha20 with RSA-4096, appending the .ENCRT extension to encrypted files. It’s a double-extortion setup: affiliates exfiltrate documents, databases, PII, and internal email to cloud file-sharing services before deploying the encryptor, then push victims to a Tor negotiation portal and threaten publication or resale of the data.
Who Was Hit: Sectors and Attack Flow
Victims span education, healthcare, manufacturing, and media. The group has confirmed hits across all four verticals, with the education and healthcare targets accounting for the bulk of the 2026 campaign.
Initial access rides on the two Fortinet CVEs. The attacker hits the FortiOS or FortiProxy appliance with a crafted request, comes back as super-admin, and drops a persistent account. That account is what keeps them in after the initial exploit window closes.
From there, the exfiltration runs to cloud file-sharing services. Volumes hit tens of terabytes per victim, pulling documents, databases, PII, and internal email. The encryptor deploys after the data is out, so the victim’s files are already gone before the .ENCRT extension lands. The Tor negotiation portal handles the double extortion: the victim gets the ransom note, and the group threatens publication or resale if the deadline misses.
Key points
- AhnLab ASEC and Korea's NIS/NPA/KISA/FSI jointly published 'Operation Double Barrel' on July 30, 2026, identifying a state-sponsored actor that has been distributing malware via Korean financial security software vulnerabilities since 2025.
- The state actor and Gunra share the same watering hole page, exploit the same financial security software vulnerability, use the same SSH key fingerprints, and run the same download/reverse tunneling infrastructure.
- Gunra's initial access exploits CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472 (CVSS 8.1) in FortiOS/FortiProxy to create persistent super-admin accounts.
- The state actor's backdoors are named Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), with a privilege escalation tool and dropper completing the chain.
- AhnLab ASEC states the two groups appear to be separate actors with different ultimate objectives but likely shared techniques, tools, and infrastructure or collaborated to a limited extent.
Further reading & sources
- [Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group) - ASEC — AhnLab Security Intelligence Center
- Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained
- Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
- Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape | Google Cloud Blog