Attackers using the Gunra ransomware altered a victim’s authentication system to create a persistent way around multi-factor authentication, according to a new joint U.S.-South Korean government advisory.
The Aug. 10 warning from the FBI, CISA, NSA, U.S. Secret Service, Department of Defense Cyber Crime Center, and South Korea’s National Police Agency details Gunra’s tactics across multiple sectors and regions.
In one attack, Gunra operators modified files that processed login requests for a corporate virtual desktop infrastructure, or VDI, portal. The changes caused a specific one-time password chosen by the attackers to validate successfully even though MFA remained enabled, giving them a persistent way back into the network.
“Most organizations treat MFA as the last line of defense,” said Jacob Krell, senior director of Secure AI Solutions & Cybersecurity at Suzu Labs. “Gunra treated it as the first thing to subvert.”
From Initial Breach to Persistent Access
Gunra’s initial access techniques were relatively familiar. The group exploited two known authentication-bypass vulnerabilities — CVE-2024-55591 and CVE-2025-24472 — in internet-facing Fortinet FortiOS and FortiProxy devices. Gunra actors also expoited weaknesses that exposed credentials, along with weak Secure Shell (SSH) access controls on VPN gateways to breach victim networks, according to the advisory.
Once inside, however, the operators moved beyond the perimeter devices they had initially compromised. In one victim environment, Gunra manipulated an SSL-VPN appliance to capture credentials and session information as employees logged in to a corporate VDI portal. The attackers then reused stolen session cookies to impersonate those users, enter the internal VDI environment, and move laterally through Remote Desktop Protocol.
Gunra also created or repurposed accounts to maintain access. The Fortinet vulnerabilities can be exploited to create a persistent super user account named “forticloud-sync” with a hardcoded password, according to the advisory. The advisory also says the operators took over an unused account and changed its configuration to bypass a required password change.
“Patching fixes the entry point,” Krell said. “It does nothing about an authentication backdoor already embedded in the MFA flow.”
Inside Gunra’s Ransomware Operation
Gunra first appeared in April 2025 as a double-extortion ransomware operation using code based on or derived from leaked Conti source code. By January 2026, the group had launched a ransomware-as-a-service program and begun recruiting affiliates, according to the advisory.
Gunra has claimed victims across healthcare, financial services, government, manufacturing, transportation, and other sectors in multiple regions.
The group steals data before encrypting systems and threatens to publish or sell the information if victims do not pay. Ransom notes direct victims to a Tor-based negotiation portal and instruct them to make contact through qTox within five to seven days.
Gunra has also targeted victims’ ability to recover. In one documented intrusion, its operators deleted backup and archived data from both the primary data center and the disaster-recovery center before and after deploying the ransomware.
Healthcare, government, and other essential-service organizations can face added pressure to restore operations when ransomware disrupts services used by the public.
“It’s one thing to say you won’t pay the bad guys when the impact is contained to your organization,” said John Strand, owner of Black Hills Information Security. “It’s another thing entirely when water, power, healthcare, or essential municipal services are disrupted.”
Hunting for Persistence After Patching
Organizations should patch the Fortinet vulnerabilities Gunra has exploited. If a compromise is suspected, the advisory directs responders to conduct threat hunting, disable malicious accounts, and secure legitimate privileged accounts.
Based on the activity described in the advisory, that hunt should include the “forticloud-sync” superuser account, altered VDI authentication files, unauthorized SSH tunnels, and other ways Gunra could maintain access.
The advisory also recommends segmenting networks to restrict lateral movement, auditing administrative accounts, applying least-privilege access controls, and testing security controls against the ATT&CK techniques it documents.
Some victims may also have a recovery option. If an incident involves a Gunra Linux variant, the advisory says responders should preserve encrypted files, file timestamps, ransom notes, and relevant system logs. Certain Linux ELF variants use weak random-number generation that may allow responders to reconstruct encryption keys from file timestamps and recover encrypted files without paying. The weakness applies only to affected Linux variants.
