Gunra Ransomware: What the Six-Agency Advisory Means for Healthcare and Financial Organizations

Also on CyberFence: CyberFence for Teams for business VPN with BAA and SSO · business VPN alternatives to NordLayer .

On August 10, 2026, six government agencies published a joint advisory warning about a ransomware campaign that has compromised hospitals, financial institutions, utilities, and government facilities across the Americas, Europe, the Middle East, and Asia-Pacific. The agencies — the FBI, CISA, the NSA, the U.S. Secret Service, the Department of Defense Cyber Crime Center, and South Korea's National Police Agency — issued advisory AA26-222A on the Gunra ransomware-as-a-service operation.

Gunra first appeared in April 2025 as a double-extortion ransomware built on the leaked Conti source code. By early 2026 it had grown into a full RaaS program — complete with a management panel, configurable ransomware builder, cross-platform locker payloads, and a structured affiliate program that recruited penetration testers and ethical hackers as initial access brokers. It also operates under the alias Golden Community.

The agencies do not issue joint advisories like AA26-222A for routine threats. When six intelligence and law enforcement organizations from two nations publish a coordinated warning — citing specific CVEs, specific tools, specific techniques, and documented ransom demands that start at "over tens of millions of dollars" — it means this campaign is active, ongoing, and causing real damage to organizations that look exactly like the ones reading this article.

How Gunra Gets In: The Fortinet Firewall Vulnerability

Gunra actors have standardized on a specific, documented initial access vector: two authentication bypass vulnerabilities in Fortinet FortiOS and FortiProxy firewall and VPN appliances.

• CVE-2024-55591 — Authentication bypass via alternate path in FortiOS and FortiProxy, granting super-administrator access
• CVE-2025-24472 — Authentication bypass via alternate path, same affected products

Both CVEs were disclosed in 2024 and 2025 respectively and patches were available. Organizations that had not applied patches to their internet-facing Fortinet devices were vulnerable. Gunra actors exploited these vulnerabilities to create a malicious persistent user account with the username forticloud-sync, hardcoded password, and super-user privileges — giving them persistent administrative access to the firewall.

The advisory also documents additional access paths:

• Credential exposure vulnerabilities in internet-facing VPN gateways
• SSH access-control vulnerabilities in VPN gateways
• Default credentials on SSL-VPN appliances when account lockout controls were absent
• Compromise of administrator accounts for SSL-VPN appliances
• Modification of unused, dormant accounts to bypass mandatory password-change requirements
• Session hijacking using stolen VDI authentication cookies

The pattern across these entry points is consistent: internet-facing remote access infrastructure — firewalls, VPN gateways, SSL-VPN — is the primary attack surface. Organizations whose perimeter devices run unpatched firmware, use default credentials, or have dormant privileged accounts are the targets Gunra affiliates look for.

What Happens After Access: Exfiltration Before Encryption

Gunra uses a double-extortion model. Before deploying the ransomware encryptor, affiliates spend significant time inside the victim network collecting sensitive data. The advisory documents what they take:

• Business-critical documents and databases
• Personally identifiable information
• Internal email communications
• System and network configuration documents
• Files from Microsoft OneDrive and SharePoint (exfiltrated using a malicious executable named main.exe)
• Enterprise server credentials and user account password hashes extracted from the NTDS file (the Active Directory credential database)
• VDI session cookies — allowing ongoing access to virtual desktop infrastructure even after passwords are changed
• Passwords stored in access control server databases (specifically Hiware systems in at least one case)
• Backup and archived data from both primary data centers and disaster recovery centers

In at least one documented case, the volume of exfiltrated data reached tens of terabytes. The exfiltrated data was compressed using 7-Zip or WinRAR, staged as archives, and exfiltrated to the Mega file-sharing service using RClone.

Gunra actors deleted backup and archived data before and after ransomware deployment in at least one victim environment — specifically targeting disaster recovery infrastructure to prevent recovery without paying the ransom.

Ransom Demands: Eight Figures, Five to Seven Day Window

Gunra's ransom demands begin in the tens of millions of dollars. The operational timeline is compressed:

• Victims receive a ransom note (named R3ADM3.txt) in every affected directory with a link to a Tor-based negotiation portal
• Victims are assigned a Client ID and initial password for the negotiation portal
• Negotiations are generally required within five to seven days
• If victims do not engage or pay, Gunra actors threaten to publish exfiltrated data on their dedicated leak site and sell it via qTox encrypted messaging

Encrypted files receive the .ENCRT extension. Volume shadow copies are deleted using Windows Management Instrumentation (WMI) before encryption, preventing local recovery. Gunra actors also directly emailed management staff at victim companies to solicit ransom payments — demonstrating that the operation invests in maintaining leverage beyond just the encryption event.

The agencies advise against paying ransoms: payment doesn't guarantee data recovery, emboldens further attacks, and funds criminal infrastructure. For organizations hit by Gunra's Linux variant, the advisory notes a recoverable weakness: the Linux encryptor uses a weak pseudorandom number generator seeded with predictable srand(time(NULL)) — meaning that defenders with file timestamps can mathematically reconstruct encryption keys and recover files without paying.

Who Gunra Targets

The advisory's documented victim list spans 10 sectors across four continents:

• Healthcare and public health — hospitals, health systems, medical providers
• Financial services and insurance — banks, credit unions, insurance companies
• Critical manufacturing and construction
• Transportation and logistics
• Government services and facilities
• Utilities
• Academia
• Media and communications
• Retail
• Professional and nonprofit services

Healthcare and financial services are specifically prioritized by Gunra affiliates for two reasons: they hold data whose exposure triggers the most severe regulatory and reputational consequences, and they face the most institutional pressure to restore systems quickly — making them more likely to pay. A hospital that can't access patient records faces immediate patient safety consequences. A bank that can't process transactions faces regulatory action within hours. This operational pressure is exactly what Gunra's five-to-seven day negotiation window is designed to exploit.

The Recommended Mitigations From the Advisory

The advisory's recommended defensive measures are specific and actionable. Priority items for healthcare and financial organizations:

Patch immediately: CVE-2024-55591 and CVE-2025-24472 in FortiOS and FortiProxy. Any internet-facing Fortinet device running unpatched firmware is a documented Gunra entry point. This is not optional.

Audit for the persistence mechanism: Look specifically for user accounts named forticloud-sync or other unexpected privileged accounts created on firewall and VPN appliances. The advisory notes that Gunra actors used these accounts for persistent access even after organizations attempted to remediate.

Remove default credentials and dormant accounts: Default credentials on SSL-VPN appliances and dormant accounts with lingering network access are documented Gunra entry points. Audit every internet-facing device for both.

Require MFA on all remote access: The advisory specifically calls out webmail, VPNs, and accounts that access critical systems. MFA doesn't make Fortinet vulnerabilities disappear, but it significantly narrows the attack surface for credential-based entry paths.

Network segmentation: Gunra affiliates move laterally from the initial access point — typically an edge device — to internal systems, Active Directory, backup infrastructure, and VDI environments. Segmenting networks to restrict lateral movement limits how far an attacker can get after initial compromise.

Protect backups separately: Gunra specifically targets backup and disaster recovery infrastructure. Offline, immutable backups stored in a physically segmented location are the recovery mechanism that makes paying the ransom genuinely optional.

Monitor for exfiltration indicators: The advisory documents specific tools used for exfiltration — 7-Zip, WinRAR, RClone, FileZilla — and a specific destination (Mega). Unusual use of these tools, particularly large compressed archives being created and transferred to external services, is a pre-encryption warning sign.

What This Means for Remote Workers and Distributed Organizations

The Gunra campaign targets internet-facing VPN infrastructure — which is the same infrastructure your remote workforce uses every day to access organizational systems. The advisory's documented entry paths include credential exposure on VPN gateways and exploitation of SSL-VPN appliances with default credentials.

This creates a defense-in-depth argument for organizations whose staff work remotely: securing the organizational VPN gateway is necessary but not sufficient. If an attacker compromises the gateway through a Fortinet vulnerability, they may have visibility into VPN sessions and the ability to intercept credentials or session tokens from employees connecting through that gateway.

Encrypting employee device connections before they reach the organizational VPN gateway — using a personal VPN like CyberFence — adds an additional layer that protects individual employee traffic even if the organizational edge is compromised. Web Shield DNS filtering also blocks the phishing and credential-harvesting domains that Gunra affiliates and initial access brokers use to collect the employee credentials they use alongside vulnerability exploitation.

The advisory's language is explicit: organizations should "require multifactor authentication for all services to the extent possible, particularly webmail, VPNs, and accounts that access critical systems." For each of those categories, encrypted, authenticated connections from employee devices are a foundational control.

The Broader Pattern This Campaign Represents

Gunra is not an isolated campaign. It's built on the Conti source code — which has been the foundation for multiple ransomware families since Conti disbanded in 2022. It operates a mature RaaS structure. It targets the same sectors — healthcare, financial services, government — that every major ransomware group has identified as high-value, high-leverage targets.

The six-agency advisory matters because it reflects how seriously these agencies are taking the campaign's damage trajectory. The technical detail in AA26-222A — specific CVEs, specific tool names, specific user account names — is a direct resource for defenders. Organizations that work through the advisory's mitigation checklist and apply the listed controls will meaningfully reduce their exposure not just to Gunra but to the broader category of ransomware that uses the same entry paths.

Patching CVE-2024-55591 and CVE-2025-24472, auditing for the forticloud-sync persistence account, enforcing MFA on VPN access, and maintaining offline backups are the controls the advisory prioritizes. Organizations that implement all four of them are substantially harder targets than those that don't.

Want to go deeper? Read the CyberFence Teams product page , the CyberFence vs. NordLayer feature comparison , or CyberFence vs. Perimeter 81 pricing and features .