The two vulnerabilities are already patched, and both hand attackers super-admin privileges on the appliance:

• CVE-2024-55591, a critical flaw allowing a remote attacker to gain super-admin privileges through crafted requests to the Node.js websocket module.
• CVE-2025-24472, a high severity flaw where a remote unauthenticated attacker with prior knowledge of upstream and downstream device serial numbers can gain super-admin privileges on the downstream device via crafted CSF proxy requests, when Security Fabric is enabled.

If your firewall or VPN gateway is running an affected FortiOS or FortiProxy version, an attacker who lands super-admin does not need to steal a user password to get in. They own the device that decides who gets in. That means account creation, configuration changes, and VPN access all become available to them under legitimate administrative authority, which is why this activity often looks like routine admin work in your logs.

Gunra is a ransomware-as-a-service operation built on the Conti ransomware source code leaked in 2022, first observed in April 2025. In early 2026 the group formalized a structured affiliate program advertised on dark web forums and began operating under additional branding, including the alias Golden Community. Internet-facing devices, specifically firewalls and VPN appliances, are its primary route to initial access.

Victims have spanned regions worldwide and multiple sectors, including healthcare, financial services, government organizations, and critical manufacturing. The pattern matters for scoping: this is not targeted at one industry, it follows exposed edge devices. Any organization running an unpatched FortiGate at the perimeter falls inside the population Gunra affiliates are scanning for.

Business Impact: From Perimeter Breach to Ransomware Deployment

The break-in starts at your edge device, and the business consequences start when the attacker stops behaving like an intruder and starts behaving like your administrator. In one case documented in the advisory, Gunra actors logged into an SSL-VPN appliance using an administrator account that still had default credentials, on a system with no account lockout controls. One unchanged password on one appliance produced full network entry.

From there the affiliates downloaded OpenSSH and built a tunnel from your compromised systems out to a server they control. That traffic looks like routine administrative activity on the wire. In another incident, they modified authentication processing files on the corporate VDI authentication portal server, which gave them continuous MFA bypass. Your multi-factor reporting keeps showing successful, compliant logins while the attacker walks through the same door.

"Patching fixes the entry point. It does nothing about an authentication backdoor already embedded in the MFA flow. I've seen organizations close the vulnerability and declare themselves clean while the attacker's persistence mechanism sat untouched in the auth stack," said Jacob Krell, senior director, secure AI solutions and cybersecurity at Suzu Labs.

Timing works against you as well. The group conducts most of its internal reconnaissance and lateral movement between 10:00pm and 6:00am in the victim's own time zone, when your administrators are offline. They also delete system and network access logs and clear command history as they go, which shortens what your investigators can reconstruct afterward.

The data loss happens before the encryption does. The FBI observed Gunra using a malicious executable to pull victim data out of Microsoft OneDrive and SharePoint, compressing sensitive files into archives and shipping them to the file-sharing service Mega. In at least one case that amounted to tens of terabytes. For most organizations, that is the contents of the document management system, HR records, client files, and contracts.

• Recovery scope: the ransomware binary filters for files consistent with user data, so servers may still boot while the information your operations depend on is unreadable.
• Notification exposure: with access logs deleted, you may be unable to prove what left the network, which complicates regulatory and contractual breach reporting.
• Negotiation pressure: ransom notes open in the tens of millions of dollars, described in the advisory as "arbitrarily high," with five to seven days to begin talks through a Tor portal.
• Executive contact: in some cases the group emails management staff directly, moving the incident onto your leadership's desk before your IT team has finished scoping it.

The double-extortion model means the payment decision does not resolve the incident. Paying may produce a decryptor, and the copies of your data still sit on infrastructure you do not control. Refusing means publication on the group's data leak site. Restoring service depends on backups either way, which is why the recovery question your board should be asking is how quickly you can rebuild without a decryption key.

Victims to date span healthcare, financial services, government organizations, and critical manufacturing, in regions around the world. In those sectors the downtime is not confined to internal systems. It reaches patient scheduling, payment processing, citizen services, and production lines, and it lasts as long as your restoration process takes.

CVE-2024-55591 and CVE-2025-24472 Exploitation Mechanics

Both Fortinet flaws under exploitation are authentication bypasses that end at the same place: super-admin on the appliance. That matters because super-admin on a FortiGate is not a foothold in the usual sense. It is control of the device that terminates your VPN sessions, holds your firewall policy, and brokers traffic between segments.

CVE-2024-55591 is reached through crafted requests to the Node.js websocket module. The attack surface is the management interface, and the request does not require valid credentials to succeed, which is what makes it attractive to an initial access operator working at scale against internet-exposed devices. MITRE maps this to T1190 (Exploit Public-Facing Application), with the outcome closer to T1078 (Valid Accounts) once the attacker holds an administrative session.

CVE-2025-24472 works differently. It abuses crafted CSF proxy requests and only applies where Security Fabric is enabled, and the attacker needs prior knowledge of the upstream and downstream device serial numbers to gain super-admin on the downstream appliance. Fortinet rated it high severity rather than critical for exactly that reason: the precondition narrows who can use it.

The two fit together in multi-appliance deployments. Serial numbers for fabric members are not secret to an operator who already holds administrative access on one device in the fabric, so a compromise achieved through the websocket path can supply the input the CSF path requires against a second appliance. The joint advisory does not prescribe a fixed order of operations for Gunra affiliates, and treating either CVE as independently sufficient is the safer assumption for threat hunting.

Affected builds are specific FortiOS and FortiProxy versions, and patches exist for both. Check the fixed release for your appliance generation in Fortinet's own advisory for each CVE instead of relying on a version number quoted secondhand, because applying an upgrade that lands on a still-vulnerable branch produces a false sense of closure.

That false sense of closure is the operational problem here. Patching removes the exploit path into the appliance. It does not remove anything the attacker installed during the window they held super-admin, and modifications made inside an authentication flow survive the upgrade untouched. Jacob Krell of Suzu Labs described watching organizations close the vulnerability, declare themselves clean, and leave the persistence mechanism sitting in the auth stack.

Forensic artifacts from this activity tend to be defined by what is missing. Gunra affiliates delete system and network access logs and clear command history, which maps to T1070.001 and T1070.003 under Indicator Removal. A discontinuity in appliance or host logging, particularly one that brackets an administrative session, is itself the finding. Once logs are gone, reconstructing scope depends on telemetry the attacker could not reach, which is why so much of the advisory's post-incident detail comes from external sources rather than victim device logs.

Timing narrows the hunt window. The group runs internal reconnaissance and hands-on activity primarily between 10:00pm and 6:00am in the victim's local time zone, when administrators are offline. Roman Sannikov of iCOUNTER noted that overnight gaps in detection coverage are precisely what the group, also operating under the alias Golden Community, is built around.

One more artifact worth capturing: the ransomware binary carries extensive filtering rules that restrict encryption to files matching user data patterns, skipping non-critical files entirely. The practical effect is a faster encryption run against the material most likely to force payment, and a smaller, more targeted set of files staged for collection.

Immediate Actions for FortiGate Administrators

Patch to the fixed FortiOS and FortiProxy builds listed in Fortinet's advisory for your appliance generation, then treat the appliance as suspect until you have proven otherwise. A patch closes the entry point and does nothing to remove an administrator account, API token, or SSH key an attacker added while the device was exposed.

Work through the appliance-level changes today. Each one removes a specific capability Gunra affiliates depend on:

• Disable HTTP, HTTPS, and SSH administrative access on WAN-facing interfaces, and set trusted-host entries on every admin account so the management interface answers only named internal addresses.
• Rotate all local admin passwords, API tokens, and SSH keys on the device, along with SSL-VPN service account credentials. Rotation is what invalidates anything harvested before you patched.
• Configure failed-login thresholds and account lockout on both the admin and SSL-VPN login paths. The advisory documents an intrusion that succeeded partly because lockout controls were absent.
• Disable Security Fabric if you do not actively use it. CVE-2025-24472 only works when Security Fabric is enabled on the downstream device.
• Compare the current admin account list, local user list, and configuration revision history against your last known-good backup, and look for entries you did not create.

This week, fix your visibility. Gunra affiliates delete system and network access logs and clear command history as they move, so anything held only on the appliance may already be gone. Forward FortiGate event, VPN, and admin logs to an external syslog target or SIEM with retention measured in months, and alert on any gap in the log stream.

Then search what you have. The group runs reconnaissance and internal activity primarily between 10:00pm and 6:00am in the victim's local time zone, when administrators are offline, so an admin authentication or configuration change in that window deserves a look even if the source address is internal. Any appliance showing unexplained log gaps, unfamiliar admin accounts, or outbound sessions to unfamiliar hosts should come off the network for imaging rather than being cleaned in place.

The identity layer needs the same attention as the firewall. Because affiliates move with stolen credentials and modified authentication files rather than malware on every hop, authentication telemetry is often the first honest signal you get. In environments Capstone manages, Adlumin ITDR correlates VPN and Microsoft 365 sign-in behavior and flags anomalies such as an admin session from an unusual location, MFA that stops being challenged for an account that previously required it, or bulk access to OneDrive and SharePoint content that precedes exfiltration.

Longer term, three changes limit what a repeat compromise can reach. Segment the network so an attacker holding the perimeter device cannot route directly to domain controllers, hypervisors, or backup infrastructure. Require MFA for all administrative access, and add file integrity monitoring to the authentication portal and VDI servers that process those MFA requests, since tampering with those files is how the group keeps working after credentials change. Keep offline, immutable backups in a physically separate, segmented location, and restore from them on a schedule so you know the copies are usable.

If you find evidence of intrusion, preserve the appliance configuration and logs before rebuilding, and report the incident to the FBI or CISA. Recovery without a ransom payment depends entirely on whether your backup copies survived untouched.

Detection and Incident Response for Gunra Ransomware Activity

Start your hunt in the overnight window. The advisory states Gunra actors run reconnaissance and internal movement between 10:00pm and 6:00am in the victim's local time zone, when administrators are offline. Pull authentication, file access, and outbound connection data for that window across the last 90 days and review it manually, because alerts that fire into an unstaffed queue are the same as no alerts at all.

Three artifact classes tie directly to behavior described in the advisory, and each one is searchable today:

• Log and history destruction. Gunra deletes system and network access logs and clears command history to slow analysis. Hunt for security log clear events on servers and network appliances, gaps where a log source stopped reporting for hours then resumed, and shell history files that are empty or truncated on Linux hosts and jump boxes.
• Microsoft 365 bulk collection. The FBI observed a malicious executable pulling victim data from OneDrive and SharePoint. In your Microsoft 365 audit logs, look for a single account performing file sync or download operations at volumes far above its own baseline, and for sync clients registering on hosts that never used them before.
• Staged archives and Mega uploads. Actors compressed sensitive data into archives and sent them to the file-sharing service Mega. Search for large archive files written to servers that do not normally create them, and for outbound HTTPS sessions to mega.nz and related endpoints from anything other than a sanctioned host.

One case in the advisory involved up to tens of terabytes of exfiltrated data, so egress volume itself is a signal. If your firewall reporting shows sustained outbound transfer from a file server or backup host during the overnight window, treat that as an active incident rather than a bandwidth question.

The encryptor also gives you a narrow detection edge. Its binary carries extensive filtering rules that target files matching user data patterns and skip everything else, which means the first encryption activity you see will concentrate on document shares and user profile directories. SentinelOne flags and blocks the defense-impairment behavior that precedes that stage, including log clearing and security tooling tampering, across managed environments.

If you confirm compromise, work in this order. Isolate the affected systems at the network layer but leave them powered on, since memory holds the credentials and tunnel state you will need. Capture volatile memory and full appliance configuration exports before any rebuild, and copy logs to write-once storage because the actors delete the originals. Then check every account that authenticated during the overnight window, not only the one you found first, as movement in these intrusions runs on stolen credentials rather than malware alone.

Restore from offline, immutable backups held in a physically separate segment. N-able Cove keeps recovery points outside the reach of an operator with domain credentials, which is the difference between restoring your file shares and negotiating for them.

On communications, notify your executive team and legal counsel at the point of confirmed data staging, before any ransom note arrives. Gunra typically allows five to seven days to open negotiations through a Tor portal, and the group has emailed management staff directly at victim organizations, so your leadership should hear about the incident from you first. Report to the FBI and CISA early, and hold customer and regulator notification until scoping tells you which records left the network.

Patching, Segmentation, and Long-Term Hardening

Turn appliance patching into a scheduled pipeline with a named owner and a service-level target, because both flaws Gunra affiliates use were patched by Fortinet before the FBI observed them in these intrusions. The gap that matters is the one between vendor release and your maintenance window.

Build the pipeline around four steps you can repeat every month:

• Maintain a live inventory of every internet-facing FortiOS and FortiProxy device, including branch appliances and units inherited through acquisitions, with firmware version and support contract status recorded against each.
• Subscribe to Fortinet PSIRT notifications and cross-check them against the CISA Known Exploited Vulnerabilities catalog, which is what the advisory tells organizations to prioritize for internet-facing systems.
• Stage the upgrade on a non-production appliance first. Restore a copy of your production configuration onto it, confirm VPN authentication, policy behavior, and SD-WAN routing still work, then keep the pre-upgrade configuration backup as your rollback point.
• Roll out to HA pairs one member at a time so a failed upgrade does not take remote access offline for the sites that depend on it.

Architecture is where you limit the damage a future authentication bypass can do. Super-admin on the edge device should not translate into reach across your internal estate. Place management interfaces on a dedicated out-of-band network reachable only through a jump host, put a reverse proxy or web application firewall in front of any published web application so the appliance is not the only thing standing between the internet and that service, and treat the VPN termination point as an untrusted zone in its own right.

Segment behind the firewall as well as at it. Domain controllers, hypervisor management, backup infrastructure, and file servers each belong in separate zones with explicit allow rules between them, so a session that arrives through a compromised VPN concentrator lands somewhere narrow. Apply the same thinking to identity: enforce MFA at your identity provider for every remote session rather than only at the appliance, since the advisory documents affiliates modifying authentication processing files on a VDI portal server to bypass MFA continuously. Certificate-based device authentication for VPN clients raises the cost further, because a stolen password alone no longer produces a session.

Monitoring needs to extend past the perimeter. EDR or XDR agents on servers and workstations behind the firewall catch the post-compromise stage that a firewall never sees, including credential dumping, remote service creation, and the archive-building that precedes exfiltration. Turn on IPS and antivirus profiles on the policies that inspect VPN and internal east-west traffic, and add outbound egress rules that restrict or log uploads to consumer file-sharing services, since Gunra moved compressed archives to Mega in at least one observed case.

Credential hygiene deserves a permanent process instead of a one-time cleanup. Passportal stores appliance admin credentials, API tokens, and rotation dates in managed environments, so a scheduled rotation for every firewall, switch, and hypervisor account becomes an auditable task with a completion record rather than something that depends on whoever last touched the device.

Assume the appliance can be compromised again and design so that event stays contained. That means offline, immutable backups tested by actual restore, network segmentation that survives the loss of the edge, and identity controls that hold when the perimeter does not.

Key Takeaway: Patch Now, Assume Compromise, Segment Later

The two Fortinet authentication bypasses Gunra affiliates use are patched, and exploitation is ongoing anyway. That combination is the takeaway. The window that matters to you is not the one between disclosure and patch release, it is the one between the day your appliance was exposed and the day you last verified what was on it.

Jacob Krell of Suzu Labs made the point directly in his comments on the advisory: patching fixes the entry point and does nothing about an authentication backdoor already embedded in the MFA flow. He described organizations that closed the vulnerability, declared themselves clean, and left the attacker's persistence mechanism sitting untouched in the auth stack. Treat a patched appliance as unverified until you have looked at it, not as resolved.

The economics explain why this group keeps returning to internet-facing edge devices. Gunra ransom notes open at tens of millions of dollars, which the advisory itself calls arbitrarily high, and victims get five to seven days to start negotiating through a Tor portal before their data goes to the leak site. In some cases the operators email management staff at the victim organization directly. Victims so far span healthcare, financial services, government, and critical manufacturing across multiple regions.

Three questions divide cleanly by role. Your CISO owns whether patch status is documented and whether the incident response plan accounts for a double-extortion negotiation clock. Your firewall administrators own the state of each appliance and its logs. Your SOC owns whether Gunra's known behaviors are visible in your telemetry. Answer those three and you know where you stand.