Gunra Ransomware Is Walking In Through Old FortiOS Auth Bypasses — CISA/FBI/NSA Joint Alert
Introduction
On August 11 CISA, FBI, NSA, Secret Service, DoD DC3, and South Korea's KNPA warned that Gunra — a Conti-derived double-extortion RaaS that surfaced in 2025 — is hitting critical infrastructure through known Fortinet bugs, not a new zero-day. Affiliates exploit CVE-2024-55591 and CVE-2025-24472, authentication bypasses in FortiOS and FortiProxy, to get super-admin on internet-facing firewalls and proxies. From there they steal data and encrypt. The Register's write-up is the operator translation: patch the edge you already knew was KEV, turn MFA on VPNs that still lack it, and keep backups Gunra cannot touch.
What Happened
CVE-2024-55591 (FG-IR-24-535) is CWE-288: crafted requests to the Node.js websocket stack yield super-admin. FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 / 7.2.0–7.2.12 were the original ranges. Fortinet documented in-the-wild use as a zero-day from late 2024; CISA put it on KEV in January 2025. CVE-2025-24472 is the sibling CSF-proxy path: with Security Fabric on, crafted proxy requests (and knowledge of serial numbers in some write-ups) yield super-admin on the downstream device. Same FortiOS 7.0.0–7.0.16 and FortiProxy trains. Fixed: FortiOS 7.0.17+, FortiProxy 7.0.20+ / 7.2.13+. FortiOS 7.2 / 7.4 / 7.6 were not in those affected lists.
The August joint CSA's new value is the crew and the follow-on. FBI watched Gunra modify authentication processing on a corporate VDI portal so a Gunra-chosen OTP always succeeded — continuous MFA bypass for that victim. Post-compromise elsewhere: Impacket, pass-the-hash / pass-the-ticket, SSH tunnels, OneDrive and SharePoint collection, then encrypt. AhnLab has separately linked some Gunra activity to a state-aligned actor in South Korea; the US/ROK advisory treats it as financially motivated RaaS with global affiliates.
FortiOS 7.0 is old. The fact that Gunra is still landing on it in August 2026 is a patch-hygiene story, not a surprise primitive.
Why It Matters
Firewall super-admin is the keys to VPN, policies, and often the identity store bind. Gunra does not need a 2026 CVE if 2024's websocket bypass is still live on the WAN. Critical-infrastructure operators who "restricted GUI to the internet but left the websocket path" are the population this CSA is written for. The VDI OTP backdoor is the reminder to hunt after you patch: the firewall fix does not un-patch a portal the actor already owned.
Who Is Affected
- FortiOS 7.0.0 through 7.0.16 (upgrade to 7.0.17 or, better, a current supported train)
- FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12
- Internet-facing FortiGate / FortiProxy management or Fabric surfaces
- Orgs whose VDI / VPN MFA was reachable from a compromised Fortinet admin session
- Critical infrastructure named in the CSA; affiliates are not sector-exclusive
How to Protect Yourself
1. Confirm FortiOS / FortiProxy is off the affected 7.0.16 / 7.0.19 / 7.2.12 trains.
# FortiGate CLI
get system status
FortiOS 7.0 must be 7.0.17 or later. Prefer moving off 7.0 entirely if your hardware train allows. FortiProxy: 7.0.20+ or 7.2.13+. Read FG-IR-24-535 for any extra workarounds if you are in a freeze — they are temporary.
2. Management plane off the WAN. Restrict GUI, SSH, and websocket admin to a jump subnet. Fabric/CSF ports are not "internal" if a peer is on the internet.
3. Hunt Fortinet logs and identity. Unexpected super-admin creations, websocket admin from WAN IPs, CSF proxy oddities, new VPN users, and config changes around the exposure window. Fortinet's original advisory included IoCs — still use them, then assume they rotated.
4. Hunt the VDI / MFA bypass the CSA described. Authentication handlers that accept a magic OTP, new IdP rules, or portal files changed by the Fortinet-admin session. Rotate every VPN, AD, and VDI secret that appliance could see. If MFA was bypassed, it is not MFA anymore until you rebuild the portal.
5. Backups: offline, immutable, tested. Segment so a firewall admin cannot reach backup media. Gunra is double-extortion; assume exfil happened if the edge was super-admin'd.