CISA and partners warn Gunra ransomware steals data before encrypting, targets exposed devices, and demands patching, MFA, segmentation, and
[SUMMARY]CISA and multiple agencies warn that Gunra ransomware continues to target exposed devices and high-value accounts, stealing data before encryption and using public leak threats for pressure. Organizations should prioritize patching Fortinet vulnerabilities, strengthening MFA, segmenting networks, and maintaining immutable backups.[
Gunra is a ransomware-as-a-service (Ransomware-as-a-Service) threat first discovered in April 2025, and its activities have drawn joint attention from CISA, the FBI, the NSA, and other multinational security and law enforcement agencies.[1][2]
The core message of this alert is clear: Gunra is not merely encryption malware, but a double-extortion model that combines data theft, public leak threats, and operational disruption pressure, and it continues to target organizations such as healthcare, finance, government, public utilities, and academic institutions.[1][3]
The advisory shows that attackers often first gain initial access, then conduct internal reconnaissance, steal data, erase traces, and finally deploy the encryptor, forming a complete and reusable attack chain.[3]
Gunra’s initial intrusion vector is highly focused, mainly revolving around externally exposed boundary devices, VPN, SSH, and phishing. Among these, Fortinet FortiOS and FortiProxy CVE-2024-55591 and CVE-2025-24472 are specifically identified as exploitable authentication bypass vulnerabilities.[1][3][4]
If such devices are not patched promptly, attackers may directly obtain unauthorized access and turn network edge devices into stepping stones for entering the internal network.[1][3]
After obtaining privileges, attackers first steal data, including internal sensitive documents and VDI configuration files, then begin the encryption process, changing victim file extensions to ".ENCRT" and leaving a ransom note named "R3ADM3.txt" in the encrypted folder.[3]
The alert also notes that Gunra demands victims respond within a deadline in the ransom note, or they may face permanent data loss or publication on a data leak site, which means the attack impacts both data confidentiality and system availability.[3]
Its activities also show typical stealth characteristics, such as preferring to carry out reconnaissance and malicious actions late at night and in the early morning, while clearing system logs and command history to reduce the chance of detection.[3]
From the attack flow, Gunra is not a single-point exploit, but rather a sustainable attack chain that integrates boundary device weaknesses, credential abuse, remote access, internal reconnaissance, and data exfiltration.[3]
The risk posed by Gunra is no longer limited to file encryption itself, but extends to data leakage, business interruption, exposure of sensitive information, and subsequent extortion pressure.[1][3]
For healthcare, finance, government, public utilities, and academic institutions, such incidents simultaneously damage service continuity, compliance obligations, and public trust, and once internal data is stolen, the resulting harm is usually far greater than a simple system outage.[1][3]
If attackers have obtained administrator accounts, default accounts, or unusual privileges, they may further access AD, VDI, NAS, servers, and other critical resources, increasing the risk of lateral movement and spread.[3]
The advisory also warns that VPN, boundary devices, and remote desktop services exposed to the internet become high-priority targets; once exploited, affected organizations may move from initial intrusion to large-scale data exfiltration and encryption in a very short time.[1][3]
The disclosed IoCs include multiple MD5, SHA1, and SHA256 values, as well as IP 86[.]54.28.216, which can be used as a reference baseline for threat hunting and alert correlation.[3]
First, patch externally facing services and boundary devices as a priority, especially VPN gateways, firewalls, and RDP, and ensure operating systems, applications, and firmware remain up to date to avoid becoming the first breakthrough point.[3]
Second, implement offline and immutable backups, and store backups in secure areas that are physically separated from the primary network and placed in independent network segments to reduce recovery risk when encryption and deletion occur at the same time.[3]
Third, segment network zones according to system functions and data criticality, and restrict unnecessary connections among servers, NAS, VDI, and other core resources to prevent a single compromised endpoint from expanding lateral movement.[3]
Fourth, fully enable MFA for VPN, enterprise email, and critical accounts, and regularly review default, disabled, and long-unused accounts; at the same time, note that MFA is not an absolute defense and credential theft, Session Tokens, and phishing bypasses must still be guarded against.[3]
Fifth, establish log collection and monitoring mechanisms covering VPN, boundary devices, AD, servers, and endpoints, with special tracking of anomalous logins, administrator privilege changes, large-scale file access, unusual data transfers, and suspicious log clearing behavior.[3]
If unknown remote logins or administrative actions are detected, immediately begin an investigation of accounts, endpoints, and network connections to prevent attackers from lingering for long periods and continuously exfiltrating data.[3]