Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2025-24472 | 8.1 | 7.0% | ✅ listed | available | 76.08 (High) |
| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |
CISA issues #StopRansomware advisory for Gunra RaaS
CISA has published a new #StopRansomware advisory for the Gunra ransomware-as-a-service (RaaS) family, providing at-risk organizations with technical details, detection logic, and mitigation guidance for the threat.
Gunra first appeared in April 2025 on Windows, with a Linux variant surfacing in July 2025. The operators launched a formal RaaS affiliate program in January 2026, opening the family to external partners who deploy the encryptor against government, critical infrastructure, and other high-value targets.
How Gunra works: ChaCha20, RSA-4096, and double extortion
Gunra encrypts files on both Windows and Linux using ChaCha20, with the symmetric key wrapped in an RSA-4096 asymmetric pair. The encryptor appends the .ENCRT extension to every targeted file, and the per-file key material is either appended to the file data or written to a separate keystore file depending on the affiliate’s configuration.
The variant is built on the Conti ransomware source code that was leaked in 2022, which explains the multithreaded encryption loop and the familiar extension-based file selection. Affiliates can tune which extensions to hit and how much of each file to encrypt, giving them control over partial encryption on large binaries or database files.
The double extortion flow runs in two stages. First, the affiliate exfiltrates documents, databases, and internal email to a cloud file-sharing service before the encryptor is deployed. If the ransom isn’t paid, the data is published to Gunra’s dedicated leak site (DLS). This means the victim’s data is already gone by the time the ransom note appears, removing the usual “we’ll delete it if you don’t pay” bluff.
Initial access via two FortiOS/FortiProxy auth bypasses
Gunra gains initial access by exploiting two authentication bypass vulnerabilities in internet-facing Fortinet FortiOS and FortiProxy appliances. The first, CVE-2024-55591, carries a CVSS 9.8 score and an EPSS probability of 98.3%, placing it at the 100th percentile for exploitation likelihood. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12, allowing a remote unauthenticated attacker to gain super-admin privileges via crafted requests.
The second, CVE-2025-24472, scores CVSS 8.1 with an EPSS of 7.0% (94th percentile) and covers the same FortiOS and FortiProxy version ranges. Both CVEs are listed in CISA’s Known Exploited Vulnerabilities catalog and have public proof-of-concept code, confirming active exploitation in the wild.
The exploit chain creates a persistent superuser account named forticloud-sync with a hard-coded password, giving the affiliate a durable foothhold on the edge device before lateral movement and encryption begin.
Who is being targeted
Gunra targets government agencies, critical infrastructure operators, and other high-value organizations across five regions: the Americas, Europe, the Middle East, Africa, and Asia-Pacific. The RaaS model lets affiliates pick their own targets, so the victim mix skews toward internet-facing Fortinet appliances and internal Windows/Linux servers holding sensitive data.
Each affiliate exfiltrates documents, databases, personally identifiable information, and internal email to a cloud file-sharing service before the encryptor runs. Exfiltration volumes reach tens of terabytes on larger deployments, which is consistent with the double-extortion flow where the data is already gone by the time the ransom note drops.
Key points
- Gunra is a RaaS family built on the 2022 Conti source code leak, first seen April 2025 on Windows with a Linux variant in July 2025 and a formal RaaS program in January 2026.
- Encryption uses ChaCha20 with RSA-4096, appending the .ENCRT extension on both Windows and Linux.
- Initial access exploits CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472 (CVSS 8.1) in FortiOS/FortiProxy to create a persistent superuser account named forticloud-sync.
- Double extortion: data is exfiltrated to cloud file-sharing before encryption, with a dedicated leak site (DLS) for publication.
- Targets government, critical infrastructure, and other organizations across Americas, Europe, Middle East, Africa, and Asia-Pacific.
Further reading & sources
- #StopRansomware: Gunra Ransomware | CISA — eCrime.ch
- Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained
- In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities - SecurityWeek
- [Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group) - ASEC