A joint August 10 advisory from the FBI, CISA, NSA, DC3, the U.S. Secret Service, and South Korea’s KNPA describes Gunra as a ransomware-as-a-service operation used against government, critical infrastructure, and organizations across many commercial sectors. The group combines data theft with encryption and threatens publication through a dedicated leak site.
The advisory is useful because it maps an intrusion chain rather than presenting only malware hashes. Defenders can turn the observed behavior into an exposure review and a focused hunt.
How Gunra gains access
The FBI observed exploitation of known vulnerabilities in internet-facing firewall and VPN appliances, including CVE-2024-55591 and CVE-2025-24472 in affected FortiOS and FortiProxy versions. KNPA also observed credential exposure and weak access controls on internet-facing VPN gateways.
In one case, attackers used default credentials against an SSL-VPN administrator account where account lockout was not enabled. This is a reminder that patching and identity controls must be evaluated together. A fully patched gateway can still be compromised by weak credentials, while strong MFA cannot compensate for a vulnerable or tampered authentication component.
What happens after initial access
Gunra affiliates use familiar administrative and offensive tools. The advisory documents Impacket components for SMB lateral movement and credential dumping, OpenSSH for tunneling, and stolen session information for access to virtual desktop infrastructure. Attackers reached domain controllers and systems used by IT personnel.
The advisory also describes a particularly important identity-security failure: attackers modified authentication processing files so that an attacker-selected one-time password would succeed. That is not a weakness in the OTP algorithm. It is compromise of the server-side authentication path. Organizations should therefore monitor the integrity of identity infrastructure and not assume that an MFA prompt proves the backend is trustworthy.
Collection, exfiltration, and impact
Before encryption, actors collected business documents, databases, personal information, and email. The FBI observed data taken from Microsoft OneDrive and SharePoint, compressed into archives, and exfiltrated to Mega. In at least one case, the volume reached tens of terabytes.
The Windows encryptor traverses accessible drive letters and targets user and business data while avoiding many operating-system files. It uses ChaCha20 with RSA-4096 and appends the .ENCRT extension; an earlier sample used .CRYPT. The ransom note is named R3ADM3.txt.
Gunra actors also used WMI to delete volume shadow copies. One victim lost backup and archived data in both the primary data center and disaster-recovery environment. A backup that shares administrative paths and trust relationships with production is not an independent recovery control.
Behavior to hunt
- Unexpected use of
psexec.py,smbclient.py, orsecretsdump.py. - New SSH tunnels or OpenSSH binaries on systems where they are not normally used.
- Access to VPN administration from workstations or virtual desktops.
- Authentication-file changes and logins using an unusual repeated OTP value.
- Large archive creation followed by RClone, FileZilla, Mega, or other cloud-transfer activity.
- Late-night reconnaissance and administrative actions between 22:00 and 06:00 local time.
- Log deletion, command-history clearing, EDR interference, or shadow-copy deletion.
- RDP or SMB movement from accounts and devices that do not normally administer servers.
- New
.ENCRTfiles orR3ADM3.txtransom notes.
Legitimate tools such as AnyDesk, 7-Zip, Visual Studio Code, RClone, and FileZilla are not indicators by themselves. Alert on execution context, destination, user, timing, and the surrounding chain.
Priority defensive actions
- Patch internet-facing gateways. Inventory VPNs, firewalls, and RDP exposure, then prioritize known exploited vulnerabilities.
- Remove defaults and enforce lockout. Eliminate default credentials and protect administrative accounts with strong, centrally monitored authentication.
- Segment administration. Keep user workstations and VDI sessions from directly managing identity, backup, and domain infrastructure.
- Protect authentication servers. Monitor file integrity, configuration changes, session issuance, and anomalous acceptance patterns.
- Test immutable backups. Keep recovery copies offline or otherwise immutable, in a segmented location, and test restoration with production identities unavailable.
- Control dual-use tools. Maintain an allowlist of expected remote-management, archive, and transfer utilities and alert on deviations.
Incident-response decision
If the organization sees a combination of VPN compromise, credential dumping, unusual tunneling, cloud exfiltration, and backup tampering, do not wait for encryption to declare an incident. The extortion phase begins when data leaves the network, not when the first file receives a new extension.
