On 10 August 2026 the FBI, CISA, the NSA, the US Secret Service, the Department of Defense Cyber Crime Center and the Republic of Korea's National Police Agency released a joint advisory on the Gunra ransomware operation (AA26-222A). Six agencies across two continents signing the same document already signals the scale of the problem. Yet the advisory matters less for its signatures than for what it contains: forensic detail drawn from real incidents investigated by the FBI and by Korean police.
Two findings stand out. First: in at least one victim organisation, Gunra operators rewrote the authentication logic of a virtual desktop portal so that a one-time password of their choosing would always validate. MFA stayed switched on — it simply no longer stopped the attackers.
The second is rare among ransomware families: the group's Linux encryptor seeds its key generation so poorly that defenders may be able to reconstruct the keys from file timestamps and, under the right conditions, recover data without paying.
From Conti offshoot to platform: how Gunra professionalised
Gunra surfaced in April 2025 as a double-extortion strain built on the Conti source code leaked in 2022, running a Tor-based leak site from the outset. In January 2026 it moved to a formal ransomware-as-a-service model: an affiliate management panel, a configurable builder, Windows and Linux lockers and structured documentation, as detailed in CloudSEK's technical dissection of the programme.
The FBI has watched the group adopt fresh aliases — most visibly Golden Community — and openly recruit penetration testers to act as initial access brokers in exchange for a share of the profits.
Negotiations open at deliberately inflated figures, typically in the tens of millions of dollars, with victims given five to seven days before their data is published. Contact runs through a Tor portal or qTox, an encrypted messaging application. The FBI has also seen the actors email victim executives directly to press for payment, with limited success.
The victim list cuts across sectors: healthcare, financial services and insurance, manufacturing and construction, transport and logistics, government, utilities, academia, media, retail and professional services, spanning the Americas, Europe, the Middle East, Africa and Asia-Pacific. On the industrial side, Dragos counted 1,140 ransomware incidents affecting industrial organisations in the second quarter of 2026, up 12% on the first; at least four were attributed to Gunra, down from eight the previous quarter.
One question remains open: the Lazarus connection. Two weeks before the advisory, The Record reported researcher observations that some tooling and infrastructure used by North Korea's Lazarus Group appeared to have been shared with Gunra in attacks on South Korean organisations. For now that is an observed overlap, not an attribution.
Where is it getting in?
Known Fortinet vulnerabilities
Nothing exotic. The FBI documents initial access through two known FortiOS and FortiProxy authentication bypasses, CVE-2024-55591 and CVE-2025-24472 — both patched since early 2025 and both previously flagged by CISA. Exploitation plants a persistent super-user account on the firewall with a name built to blend in: forticloud-sync.
Weak credentials on exposed gateways
Korean police supply the other half of the picture: internet-facing VPN gateways compromised through exposed credentials, SSH access-control weaknesses and, in one documented case, the default credentials of an SSL-VPN administrator account on a device with no lockout policy at all.
The pattern matches something we have covered before: edge devices — firewalls, VPNs, load balancers — are the EDR's blind spot and account for a growing share of initial access. If your vulnerability management does not prioritise these devices the moment they hit the KEV catalogue, it is prioritising the wrong queue. We wrote about how to order that queue in KEV, EPSS and SSVC.
The VDI portal case: a back door inside MFA
The most instructive incident in the advisory was investigated by Korean police. Already on a network administrator's workstation, the attackers opened the SSL-VPN's administrative web console and found an unused account with access to both the internet-facing and internal networks. They edited its configuration to sidestep the mandatory password change and made it their working identity.
They then abused the VPN appliance's traffic-control features to capture the credentials and session data of users authenticating to the corporate virtual desktop (VDI) portal. With stolen session cookies they impersonated legitimate users — the same session-hijacking logic we saw with Citrix Bleed 2 — and moved over RDP to the VDI authentication server, the Active Directory controller and the IT team's own desktops.
On that authentication server they took the most surgical step of the intrusion: altering the files that process validation so that one specific, attacker-chosen OTP would always be accepted. A back door inside MFA. No dashboard gives it away: the second factor remains configured, users keep using it, and box-ticking reviews keep signing it off.
From there it was routine work at scale: dumping the NTDS file with secretsdump to extract the domain's password hashes, then pass-the-hash and pass-the-ticket — replaying those hashes and tickets to authenticate without ever knowing a password — for lateral movement.
The final step did the most damage: from a compromised virtual desktop they reached an access-control server over SSH and stole the symmetric key it held. That key decrypted every enterprise server password stored in the access-control server's database — and with those credentials they deployed the encryptor against database servers and NAS storage.
Why the usual controls miss it
Because almost everything Gunra does looks like systems administration. Its toolbox is legitimate and mundane: Impacket, RClone, FileZilla, 7-Zip, WinRAR, AnyDesk, MobaXterm, DBeaver, even Visual Studio Code and Slack. Only Sliver and Mimikatz are items a software inventory would flag on sight.
The encryptor is no more cooperative. It is self-contained, produces no observable network traffic — no DNS, no HTTP — checks for debuggers via IsDebuggerPresent and skips system directories so the machine keeps booting.
The operators keep antisocial hours: the advisory documents activity concentrated between 22:00 and 06:00, with systematic deletion of logs and command history. Little of it is sophisticated; all of it is chosen to pass unnoticed.
Exfiltration does not always cross your network either. A purpose-built executable (main.exe) pulls content straight out of OneDrive and SharePoint, and compressed archives end up on the Mega file-sharing service. At one victim organisation the volume reached tens of terabytes.
Behavioural detection: what to watch in your telemetry
The advisory yields signals that are concrete and cheap to monitor with tooling you already run.
On Windows
Watch for the WMIC shadowcopy delete command (shadow copies wiped just before encryption), anomalous access to NTDS.dit or directory replication requests from machines that are not domain controllers, and RClone, FileZilla or AnyDesk appearing on servers that never had them.
At the edge
Pay attention to local account creation on firewalls (the forticloud-sync user appears verbatim in the advisory's indicators), outbound SSH tunnels from network appliances to unknown servers, and administrative sessions outside working hours — the 22:00–06:00 window works as a practical filter for triaging privileged-access alerts.
Late-stage markers
Two unambiguous, if late, signals: mass renaming of files to the .ENCRT extension and R3ADM3.txt ransom notes appearing in directories. By then you are past detection and into response. A threat hunting service that pursues behaviour rather than signatures fits what the advisory asks of defenders; at Hard2bit Cybersecurity we run that work against the MITRE ATT&CK mapping the document provides.
The Linux variant: keys you can rebuild
Trend Micro documented Gunra's Linux variant in July 2025. In March 2026, Breakglass Intelligence published details of a remarkable design flaw: the key generator is seeded with srand(time(NULL)) — the system clock. Using the timestamps of encrypted files (the .GNRA extension), defenders may be able to reconstruct the keys mathematically and recover data without paying.
The official advisory takes that route seriously: its incident response guidance cites the research and explicitly asks victims to preserve encrypted files, timestamps, ransom notes and logs before doing anything else. It is rare for official response guidance to put a possible recovery path on the record; if the Linux variant hits you, that preservation step may be the difference between restoring and paying.
Defence: what the advisory asks for, and the deeper failure
The document's mitigations are familiar but well ranked: prioritise patching of exposed systems (VPN gateways and RDP-facing infrastructure first); require a second factor on every service; review new or dormant accounts on controllers and directories; restrict command-line tooling; and apply network segmentation to contain lateral movement.
The backup point deserves separate mention. At one victim organisation, the operators deleted backups and archived data at both the primary data centre and the disaster recovery site, before and after deploying the encryptor. Immutable, offline backups held in a segregated location would have been the only part of the plan the attacker could not reach. Testing the restore matters as much as keeping the copy.
The structural conclusion points elsewhere. Identity infrastructure — the VPN gateway, the VDI portal, the access-control server — has become the actual target, and MFA is not a box to tick but a system to defend, with file integrity monitored and administrative access accounted for. An organisation that cannot say who touched its authentication portal's configuration yesterday has the same gap these victims had.
If you suspect an active intrusion, Hard2bit's incident response team can help you scope the compromise and evict the actor before encryption. We have been working at exactly that stage since 2013 — the one that decides whether an intrusion ends in containment or in crisis.
This article draws on joint advisory AA26-222A (FBI, CISA, DC3, NSA, USSS and KNPA) and public third-party research, reflecting information available as of 13 August 2026. Techniques and indicators may evolve. Validate any detection or blocking measure in a test environment before deploying it to production, and adapt these recommendations to your organisation's context.
