Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

The growing activity associated with the Gunra ransomware operation demonstrates how ransomware groups are increasingly combining exploitation of internet-facing security devices, weaknesses in operational-technology equipment, credential theft and sophisticated post-compromise techniques to move deeply into enterprise environments before deploying encryption. Cybersecurity agencies from South Korea and the United States have warned that Gunra operators have targeted organizations in healthcare, financial services, government, professional services and other critical sectors, using vulnerabilities affecting Fortinet FortiOS and FortiProxy devices as well as Schneider Electric PowerLogic P5 equipment to gain access. Once inside, the attackers have demonstrated capabilities extending far beyond ordinary ransomware deployment, including session hijacking, authentication manipulation, credential dumping, lateral movement, terabytes of data theft and deliberate destruction of backup infrastructure. 

The Fortinet vulnerability involved in the reported attacks, CVE-2025-24472, affects FortiOS and FortiProxy appliances that commonly provide firewalling, VPN and secure-access functionality at the enterprise perimeter. These devices occupy a particularly valuable position because they are exposed to external users while simultaneously possessing trusted connectivity toward internal systems. Compromising one can provide attackers with access that would otherwise require phishing an employee, stealing credentials and navigating several layers of network security.

This is precisely why security appliances continue to receive disproportionate attention from sophisticated ransomware operators. A firewall or VPN gateway is designed to decide which connections may cross the enterprise boundary. Once attackers control that device, they gain influence over the mechanism responsible for enforcing the boundary itself. The distinction between being outside and inside the network becomes considerably less meaningful.

Gunra attacks have also exploited CVE-2024-5559 affecting Schneider Electric PowerLogic P5 protection relays. PowerLogic P5 devices are used for protection and control within electrical distribution environments, making this element of the campaign particularly important for organizations operating industrial infrastructure. Schneider Electric identifies affected PowerLogic P5 versions up to 01.500.104 in its security notification and classifies the underlying problem as use of a broken or risky cryptographic algorithm.

The combination of Fortinet and Schneider Electric vulnerabilities shows that ransomware actors are no longer restricting themselves to Windows servers and employee endpoints. Enterprise networks increasingly contain firewalls, VPN gateways, industrial controllers, protection relays, virtual infrastructure and specialized access-control systems, each representing another possible route toward privileged access. Attackers will use whichever component provides the easiest path into the environment.

This should change the way organizations think about ransomware prevention. Traditional ransomware programmes often focus heavily on endpoint protection and email phishing because malicious attachments and compromised workstations historically represented common entry points. Those protections remain important, but an attacker exploiting an exposed VPN appliance or industrial device may bypass the employee endpoint entirely.

Vulnerability management therefore needs to prioritize systems according to their network position and exploitation status rather than relying solely on CVSS scores. Internet-facing firewalls, VPN gateways, application delivery systems and OT gateways should receive emergency remediation when vulnerabilities are known to be exploited. A critical vulnerability on a device sitting directly between the internet and internal infrastructure creates substantially greater immediate risk than an equally severe flaw buried inside an isolated laboratory system.

The Gunra campaign also demonstrates why patching alone cannot be considered sufficient once exploitation is suspected. Attackers gaining administrative access to perimeter infrastructure may create accounts, modify configuration, steal credentials or install persistence before an organization installs the security update. Updating the vulnerable software removes one path into the system but does not automatically remove access the attacker established previously.

Organizations that operated affected Fortinet or Schneider Electric systems should therefore perform historical compromise assessments rather than merely verifying their current software versions. Administrative logs, VPN authentication activity, configuration changes, new accounts, unexpected outbound connections and unusual internal traffic should be investigated throughout the period during which vulnerable devices were reachable.

One of the most concerning techniques attributed to Gunra involves manipulating SSL-VPN network traffic to intercept authentication credentials and session information transmitted by users attempting to access a corporate virtual-desktop environment. By operating from a compromised device positioned in the authentication path, attackers were reportedly able to observe and collect information that users legitimately supplied to trusted corporate infrastructure.

This illustrates why encrypted traffic and authentication systems must be considered carefully when the network appliance terminating or inspecting those connections is compromised. Encryption protects data while travelling across untrusted networks, but it cannot protect information from a device that legitimately decrypts or terminates that session. A VPN gateway controlling the secure connection can therefore become an extremely effective credential-collection platform once attackers control it.

The attackers reportedly used stolen session cookies to hijack authenticated sessions and impersonate legitimate users when accessing internal infrastructure. Session theft is particularly dangerous because it can bypass some forms of multi-factor authentication. The victim may have completed MFA correctly, but the attacker steals the resulting authenticated session rather than attempting to reproduce the original authentication process.

This reinforces the importance of monitoring session behaviour rather than treating successful MFA as proof that all subsequent activity is legitimate. A session suddenly appearing from a different device, geography or network immediately after legitimate authentication should generate investigation. Sensitive applications can also bind sessions more strongly to device identity and continuously evaluate risk throughout the session rather than authenticating once and trusting indefinitely.

Gunra operators went further by modifying authentication-processing files on a corporate VDI authentication portal so that a specific attacker-selected one-time password would be accepted. This technique effectively creates an authentication backdoor. Rather than stealing a legitimate OTP for every login attempt, the attackers altered the authentication mechanism itself so their chosen value became valid.

This is an important distinction because MFA cannot protect an organization when attackers control the software responsible for validating MFA. Security teams sometimes treat multi-factor authentication as an absolute defence against credential compromise, but the effectiveness of MFA still depends on the integrity of the identity provider, VPN gateway, authentication portal and supporting infrastructure.

Authentication infrastructure therefore requires file-integrity monitoring, strong administrative controls and centralized logging. Unexpected changes to authentication scripts, libraries or configuration should be treated as high-priority security events because they can silently undermine protections relied upon across the organization.

The campaign also demonstrates extensive credential theft after initial access. Gunra actors reportedly accessed a system access-control server and obtained a symmetric encryption key used to protect stored enterprise-server credentials. With the key, attackers could decrypt passwords associated with numerous systems and use those accounts for subsequent lateral movement and ransomware deployment.

This is a particularly dangerous concentration of trust. Systems designed to centrally manage privileged access can become enormously valuable targets because compromising one platform may provide credentials for many other servers. Privileged-access management and system access-control infrastructure should therefore be isolated and protected more strongly than ordinary application servers.

Encryption of stored credentials provides limited protection when the decryption key is stored on the same accessible system. An attacker obtaining both the encrypted database and the corresponding encryption key can simply recreate the legitimate decryption process. Key management should therefore separate cryptographic secrets from the data they protect and use hardware-backed or independently controlled key-management systems where practical.

Privileged credentials should also be short-lived wherever possible. Permanent administrator passwords stored centrally for years provide attackers with reusable access after compromise. Just-in-time credentials and automatically rotated secrets reduce the period during which stolen authentication material remains useful.

Gunra operators use several Impacket utilities during lateral movement and credential extraction, including `psexec.py`, `smbclient.py` and `secretsdump.py`. These are legitimate tools frequently used by penetration testers and system administrators, but attackers use them because they provide reliable implementations of Windows networking and authentication protocols. Security products cannot therefore rely solely on identifying the tool name as malicious.

Defenders should instead monitor behaviour associated with the tools. Remote service creation, unusual SMB administration, access to domain-controller credential stores and extraction of NTDS information should generate alerts regardless of which executable performs the operation. Behavioural controls remain effective even when attackers modify filenames or replace Impacket with another toolkit.

Credential dumping against domain controllers is particularly serious because the Active Directory NTDS database can contain password hashes for large numbers of users and computers. Once domain credentials are obtained, attackers can impersonate legitimate identities and distribute ransomware using normal administrative mechanisms.

Domain controllers should consequently receive the strongest available endpoint monitoring, privileged-access restrictions and network segmentation. Administrative access should originate only from dedicated management systems, and ordinary employee workstations should never communicate with sensitive domain-controller management interfaces.

Gunra actors have also reportedly targeted virtual desktop infrastructure used by IT personnel and searched for documents containing system and network configuration information. This behaviour demonstrates why attackers frequently target administrators rather than immediately encrypting whatever system they first compromise. An IT administrator's environment may contain network diagrams, passwords, device configurations and scripts that reveal how the organization is structured.

Sensitive architecture documentation should therefore be protected according to the value it provides an attacker. Network diagrams, firewall configurations and disaster-recovery procedures should not be available broadly through shared drives simply because they contain no customer information. From an attacker’s perspective, these documents can provide a roadmap toward the organization’s most valuable systems.

The attackers also exfiltrated very large quantities of information before deploying ransomware. In some cases, terabytes of data were compressed and transferred to the MEGA file-sharing service, while Microsoft OneDrive and SharePoint data were reportedly collected using a dedicated executable. This demonstrates how ransomware operations have evolved into large-scale data-theft campaigns where encryption becomes only the final stage.

Double extortion gives attackers two forms of leverage. Even when an organization can restore its systems from backup, the attackers threaten to publish or sell stolen information. According to reporting on Gunra, victims are typically given only several days before data may be released publicly.

Organizations therefore need controls capable of detecting exfiltration before ransomware deployment. Large archive creation, unusual access to SharePoint or OneDrive data, outbound transfers toward consumer file-sharing services and sudden reading of large numbers of documents should trigger investigation.

Cloud applications require the same level of data-loss monitoring as traditional file servers. Enterprises increasingly store sensitive information in Microsoft 365 and other SaaS platforms, but security monitoring sometimes remains concentrated around on-premises network traffic. Attackers using valid credentials may retrieve cloud data through legitimate APIs without generating conventional malware indicators.

User and entity behaviour analytics can help identify this activity. An account that normally opens a handful of documents each day but suddenly downloads thousands of files or retrieves information from unfamiliar SharePoint sites should generate a risk signal even when authentication succeeds.

The Gunra campaign also demonstrates deliberate attempts to hide attacker activity. Operators have reportedly deleted system and network-access logs, cleared command histories and conducted reconnaissance primarily between approximately 10 p.m. and 6 a.m. Such behaviour suggests awareness that many organizations have reduced staffing and monitoring overnight.

Security monitoring for critical environments must therefore operate continuously. Attackers understand business hours perfectly well and have no obligation to respect them. High-risk alerts generated overnight require either an internal 24-hour security operations capability or a managed service capable of investigating them promptly.

Centralized logging becomes essential because logs stored only on compromised endpoints or network devices can be deleted by attackers. Authentication events, firewall changes, VPN activity, domain-controller logs and cloud audit records should be forwarded to independent systems where attackers cannot easily erase historical evidence.

The destruction of backup infrastructure observed in Gunra incidents is especially concerning. Attackers reportedly deleted backup and archival data from both primary data centers and disaster-recovery environments before and after ransomware deployment. This demonstrates that a disaster-recovery site is not automatically a cyber-recovery solution.

If the same administrator accounts, management interfaces and network trust connect production and DR infrastructure, an attacker compromising the enterprise can often reach both. Geographic separation protects against fires or floods but provides little protection against credentials that work everywhere.

Organizations need immutable or offline recovery copies that cannot be deleted using normal production credentials. Backup administration should use separate identities, and management interfaces should be isolated from ordinary domain access. Critical recovery systems should require additional authorization for deletion or retention-policy changes.

Recovery procedures must also be tested regularly. A backup is useful only if the organization can restore from it within an acceptable period and if the backup itself has not silently preserved malware or attacker-created configuration.

Gunra reportedly provides both Windows and Linux ransomware variants, demonstrating the need to protect infrastructure beyond Windows endpoints. Modern enterprises increasingly run virtual infrastructure, databases, containers and storage systems on Linux, and ransomware operators recognize that encrypting these platforms may cause greater operational disruption than encrypting individual workstations.

Network-attached storage systems are also targeted because they frequently contain centralized business data and backups. NAS administration should use separate credentials, restricted management networks and snapshots protected from ordinary administrator deletion wherever the platform supports them.

The ransomware operation has evolved into a ransomware-as-a-service model, providing affiliates with management infrastructure, configurable builders and cross-platform payloads. This development matters because it allows more attackers to participate without developing ransomware themselves. Affiliates can specialize in finding vulnerable organizations while the core group maintains the encryption and extortion infrastructure.

Gunra has reportedly attempted to recruit penetration testers and ethical hackers as initial-access brokers by offering a share of ransom proceeds in exchange for access to enterprise networks. This reflects the continuing professionalization of the ransomware ecosystem, where access discovery, intrusion, data theft, encryption and negotiation may be handled by different participants.

Defenders should therefore expect tactics to vary between incidents even when the final ransomware family is the same. One affiliate may exploit Fortinet infrastructure, another may rely on phishing and a third may purchase compromised credentials. Detection strategies focused exclusively on one known initial-access technique will inevitably miss others.

The involvement of vulnerabilities in Schneider Electric equipment also highlights the growing intersection between ransomware and operational technology. Ransomware actors historically concentrated on IT systems because those systems contained data and business applications that could be monetized quickly. As IT and OT environments become increasingly connected, however, industrial equipment may provide another entry path or another source of operational leverage.

Organizations operating industrial networks should isolate OT management interfaces from the public internet and from ordinary corporate user networks. Communication between IT and OT should pass through tightly controlled gateways permitting only explicitly required protocols and systems.

Protection relays, PLCs, engineering workstations and other industrial devices should be inventoried with exact firmware versions so vulnerabilities can be identified rapidly. Asset visibility remains one of the largest challenges in OT environments because devices may remain operational for decades and are not always included in conventional vulnerability-management platforms.

Industrial patching often requires more planning than ordinary server updates because outages can affect physical processes. Organizations therefore need compensating controls such as segmentation, access restrictions and monitoring that reduce risk during the period before an update can safely be deployed.

The campaign also demonstrates why organizations should maintain multiple independent security boundaries. A compromised firewall should not automatically provide domain administration. A stolen user session should not provide access to backup infrastructure. A compromised system-access server should not contain permanent credentials capable of reaching every enterprise host.

This concept is the practical foundation of zero-trust architecture. Every access request should be limited according to identity, device, application and purpose rather than assuming that traffic coming from an internal address or VPN connection is trustworthy.

Remote-access infrastructure deserves particular attention because Gunra has demonstrated the ability to manipulate VPN authentication and session flows. VPN appliances should be patched rapidly, management interfaces should remain inaccessible from the public internet, and administrative authentication should use phishing-resistant MFA.

However, organizations must recognize the limitation demonstrated by this campaign: MFA cannot compensate for a fully compromised authentication appliance. Monitoring the integrity of the device enforcing MFA is as important as deploying MFA itself.

Configuration backups of firewalls, VPN gateways and OT equipment should be maintained separately so investigators can compare running configurations against trusted baselines. Unauthorized changes to traffic rules, authentication settings or routing may provide evidence that attackers modified security infrastructure before deploying ransomware.

Network configuration monitoring can detect this type of activity earlier than endpoint security because the attacker may operate predominantly through devices that cannot run traditional EDR software.

The emergence of Gunra also reinforces the value of CISA’s Known Exploited Vulnerabilities approach. Organizations face thousands of security advisories and cannot treat every vulnerability as an emergency. Evidence that a vulnerability is actively being used by ransomware or other threat actors provides a far stronger prioritization signal than theoretical severity alone.

Internet-facing systems associated with known exploitation should therefore receive accelerated remediation even when normal change-management processes would schedule updates weeks later. Organizations need emergency procedures capable of testing and deploying high-risk fixes without excessive administrative delay.

Security teams should also assess whether an exposed system was vulnerable before remediation. The absence of current vulnerability does not establish the absence of previous compromise. Historical VPN logs, administrative events and unusual authentication activity may reveal intrusion attempts that occurred weeks earlier.

When compromise of a perimeter device is confirmed, credentials accessible through that device should be treated as potentially exposed. Administrators should rotate secrets, invalidate active sessions and investigate accounts that authenticated through the compromised system.

The relationship between Gunra and state-sponsored activity also requires careful interpretation. South Korean researchers observed technical overlaps between some Gunra incidents and campaigns involving vulnerabilities in financial security software also associated with malware used by North Korean-linked actors. These similarities may indicate shared tools, infrastructure or limited cooperation, but they do not establish that Gunra itself is a North Korean state operation.

This distinction matters because technical overlap is not equivalent to attribution. Cybercriminals routinely reuse publicly available tools, purchase access from the same brokers and operate through overlapping infrastructure. Defenders should focus on observable behaviour and remediation rather than assigning geopolitical conclusions unsupported by evidence.

The attack patterns are nevertheless important because they demonstrate how ransomware and state-sponsored ecosystems can intersect. Initial-access techniques developed or discovered in one context may eventually become available to financially motivated groups, while criminal infrastructure can sometimes provide useful cover for espionage operations.

Organizations should therefore assume that valuable vulnerabilities will eventually spread across different attacker communities. A flaw being exploited initially by one sophisticated group does not mean other actors will remain unaware of it for long.

The Gunra campaign ultimately demonstrates that ransomware is no longer primarily an endpoint malware problem. The encryption executable appears only near the end of an intrusion that may already have involved perimeter exploitation, credential interception, session hijacking, identity-system manipulation, lateral movement, cloud data theft and backup destruction.

Preventing the final ransomware executable from running is valuable, but organizations gain far more defensive opportunity by identifying the earlier stages. Unexpected VPN configuration changes, abnormal credential access, unusual SMB movement, large cloud downloads and attempts to reach backup infrastructure can provide warnings before encryption begins.

The strongest ransomware defence is therefore an architecture in which no single compromised component gives the attacker everything required for the next stage. Edge devices should be patched and isolated, identity systems should be independently protected, network access should be segmented, privileged credentials should be temporary and backups should remain inaccessible from ordinary production administration.

For organizations using affected Fortinet or Schneider Electric products, the immediate priority should be identifying vulnerable versions, applying vendor fixes and reviewing historical activity for evidence of exploitation. Internet-facing administration should be removed wherever unnecessary, and compromised security appliances should be treated as potentially hostile infrastructure rather than trusted devices merely because they carry a security vendor’s logo.

The broader lesson from Gunra is uncomfortable but useful: ransomware groups increasingly attack the systems organizations rely upon to enforce security itself. VPN gateways, firewalls, access-control servers and industrial devices are valuable precisely because defenders trust them.

The objective of resilient security architecture should therefore be to ensure that compromising one trusted system does not automatically transfer that trust to the attacker controlling it.

Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. "Gunra is another variant in the ongoing trend of

Source: Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks via The Hacker News — published 11 Aug 2026.