[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPbP_AED-60myVSTboBJl6zRYhZmavrmokX8Xq3c2IQs":3,"$fxD_YC_6PAGkV5fE2Fmn5Icyn8epeEXKMWM0ShSrGPWU":70},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":67,"created_at":68,"updated_at":69,"published_at":46},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","Gunra RaaS, built on leaked Conti source, uses ChaCha20+RSA-4096 double-extortion and exploits two FortiOS\u002FFortiProxy auth bypasses (CVE-2024-55591, CVE-2025-24472) to drop persistent superusers.","CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.",[10,11,12,13,14,15],"CISA","Gunra","Ransomware","FortiOS","FortiProxy","CVE-2024-55591","# CISA Issues #StopRansomware Advisory for Gunra Ransomware\n\n*Gunra RaaS, built on leaked Conti source, uses ChaCha20+RSA-4096 double-extortion and exploits two FortiOS\u002FFortiProxy auth bypasses (CVE-2024-55591, CVE-2025-24472) to drop persistent superusers.*\n\n**Tags:** `CISA` `Gunra` `Ransomware` `FortiOS` `FortiProxy` `CVE-2024-55591`\n\n> CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2025-24472 | 8.1 | 7.0% | ✅ listed | available | 76.08 (High) |\n| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |\n\n## CISA issues #StopRansomware advisory for Gunra RaaS\n\nCISA has published a new #StopRansomware advisory for the Gunra ransomware-as-a-service (RaaS) family, providing at-risk organizations with technical details, detection logic, and mitigation guidance for the threat.\n\nGunra first appeared in April 2025 on Windows, with a Linux variant surfacing in July 2025. The operators launched a formal RaaS affiliate program in January 2026, opening the family to external partners who deploy the encryptor against government, critical infrastructure, and other high-value targets.\n\n## How Gunra works: ChaCha20, RSA-4096, and double extortion\n\nGunra encrypts files on both Windows and Linux using ChaCha20, with the symmetric key wrapped in an RSA-4096 asymmetric pair. The encryptor appends the `.ENCRT` extension to every targeted file, and the per-file key material is either appended to the file data or written to a separate keystore file depending on the affiliate’s configuration.\n\nThe variant is built on the Conti ransomware source code that was leaked in 2022, which explains the multithreaded encryption loop and the familiar extension-based file selection. Affiliates can tune which extensions to hit and how much of each file to encrypt, giving them control over partial encryption on large binaries or database files.\n\nThe double extortion flow runs in two stages. First, the affiliate exfiltrates documents, databases, and internal email to a cloud file-sharing service before the encryptor is deployed. If the ransom isn’t paid, the data is published to Gunra’s dedicated leak site (DLS). This means the victim’s data is already gone by the time the ransom note appears, removing the usual “we’ll delete it if you don’t pay” bluff.\n\n## Initial access via two FortiOS\u002FFortiProxy auth bypasses\n\nGunra gains initial access by exploiting two authentication bypass vulnerabilities in internet-facing Fortinet FortiOS and FortiProxy appliances. The first, CVE-2024-55591, carries a CVSS 9.8 score and an EPSS probability of 98.3%, placing it at the 100th percentile for exploitation likelihood. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12, allowing a remote unauthenticated attacker to gain super-admin privileges via crafted requests.\n\nThe second, CVE-2025-24472, scores CVSS 8.1 with an EPSS of 7.0% (94th percentile) and covers the same FortiOS and FortiProxy version ranges. Both CVEs are listed in CISA’s Known Exploited Vulnerabilities catalog and have public proof-of-concept code, confirming active exploitation in the wild.\n\nThe exploit chain creates a persistent superuser account named `forticloud-sync` with a hard-coded password, giving the affiliate a durable foothhold on the edge device before lateral movement and encryption begin.\n\n## Who is being targeted\n\nGunra targets government agencies, critical infrastructure operators, and other high-value organizations across five regions: the Americas, Europe, the Middle East, Africa, and Asia-Pacific. The RaaS model lets affiliates pick their own targets, so the victim mix skews toward internet-facing Fortinet appliances and internal Windows\u002FLinux servers holding sensitive data.\n\nEach affiliate exfiltrates documents, databases, personally identifiable information, and internal email to a cloud file-sharing service before the encryptor runs. Exfiltration volumes reach tens of terabytes on larger deployments, which is consistent with the double-extortion flow where the data is already gone by the time the ransom note drops.\n\n## Key points\n\n- Gunra is a RaaS family built on the 2022 Conti source code leak, first seen April 2025 on Windows with a Linux variant in July 2025 and a formal RaaS program in January 2026.\n- Encryption uses ChaCha20 with RSA-4096, appending the .ENCRT extension on both Windows and Linux.\n- Initial access exploits CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472 (CVSS 8.1) in FortiOS\u002FFortiProxy to create a persistent superuser account named forticloud-sync.\n- Double extortion: data is exfiltrated to cloud file-sharing before encryption, with a dedicated leak site (DLS) for publication.\n- Targets government, critical infrastructure, and other organizations across Americas, Europe, Middle East, Africa, and Asia-Pacific.\n\n## Further reading & sources\n\n- [#StopRansomware: Gunra Ransomware | CISA](https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa26-222a) — eCrime.ch\n- [Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained](https:\u002F\u002Fwww.picussecurity.com\u002Fresource\u002Fblog\u002Fgunra-ransomware-multithreaded-chacha20-encryption-explained)\n- [In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities - SecurityWeek](https:\u002F\u002Fwww.securityweek.com\u002Fin-other-news-rapid7-layoffs-hacking-a-boeing-737-refrigeration-system-vulnerabilities)\n- [[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group) - ASEC](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F94696)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5",{"cves":19,"iocs":35,"actors":41,"malware":48,"targets":50,"timeline":55,"industries":60,"technologies":64},[20,28],{"id":15,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2024-55591",9.8,0.9415,"Critical",89.88,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":31,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":27},"CVE-2025-24472","\u002Fvulnerabilities\u002FCVE-2025-24472",8.1,0.0724,"High",77.58,[36,39],{"type":37,"value":38},"other","forticloud-sync",{"type":37,"value":40},".ENCRT",[42],{"url":43,"name":11,"slug":44,"type":45,"origin":46,"motivation":47},"\u002Fthreat-groups\u002Fgunra","gunra","ransomware",null,"financial",[49],{"name":11},[51],{"name":52,"sector":53,"status":54,"geography":46},"Boeing","aerospace","confirmed",[56],{"date":57,"event":58,"description":59},"2025-04","First seen","Gunra first seen on Windows",[61],{"url":62,"name":63,"slug":53},"\u002Findustries\u002Faerospace","Aerospace",[65],{"vendor":66,"product":13},"Fortinet","ransomware_incident","2026-08-27T17:06:47.703652+00:00","2026-10-16T12:29:14.248116+00:00",{"articles":71},[72,82,92,103],{"slug":73,"title":74,"summary":75,"tags":76,"hero_image_url":79,"story_type":80,"created_at":81},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.",[11,77,78,13,14,12],"AhnLab ASEC","Operation Double Barrel","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","threat_actor_activity","2026-09-18T07:15:06.272711+00:00",{"slug":83,"title":84,"summary":85,"tags":86,"hero_image_url":90,"story_type":80,"created_at":91},"forescout-researchers-identify-new-ransomware-coterie-mora-001-running-superblac","Forescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0","Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.",[87,88,89,13,14,15],"Mora_001","SuperBlack","LockBit 3.0","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fforescout-researchers-identify-new-ransomware-coterie-mora-001-running-superblac.png?v=ed02f05fb9","2026-09-21T07:06:18.647672+00:00",{"slug":93,"title":94,"summary":95,"tags":96,"hero_image_url":101,"story_type":67,"created_at":102},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[97,98,99,12,100],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":112,"story_type":67,"created_at":113},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[108,12,109,110,111],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00"]