Gunra is a Ransomware-as-a-Service (RaaS) family derived from leaked Conti source code and designed to target both Windows and Linux systems. The operators use double extortion tactics, stealing large volumes of data to cloud services before launching file encryption. Gunra relies on ChaCha20 combined with RSA-4096 encryption and appends the .ENCRT extension to encrypted files.
The report explains how Gunra operators gain initial access by exploiting FortiOS vulnerabilities and creating persistent superuser accounts. Investigations show the attackers use Impacket libraries for lateral movement and SMB abuse, while also stealing credentials from VDI and Hiware systems. They further manipulate MFA configurations to preserve long-term access to compromised environments.
Organizations should patch FortiOS and FortiProxy systems against CVE-2024-55591 and CVE-2025-24472. Security teams should monitor for unauthorized accounts such as forticloud-sync and detect suspicious use of Impacket tools. Protecting volume shadow copies and validating MFA and authentication configuration files are also critical defensive measures.
If Gunra activity is detected, affected systems should be isolated immediately to limit lateral movement over SMB or RDP. Unauthorized superuser accounts should be revoked, and authentication processing files should be reviewed for MFA backdoors. Organizations should reset enterprise credentials and investigate cloud storage activity for signs of unauthorized data exfiltration.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: An adversary has successfully leveraged a chain of vulnerabilities (CVE-2024-55591 and CVE-2025-24472) to bypass authentication on a FortiOS device. To ensure long-term access (persistence), the attacker executes a command to create a new user account. To blend in with legitimate system processes and cloud synchronization services, the attacker names the account ‘forticloud-sync’. This action generates a Windows Event ID 4720 on the integrated identity provider, which is the primary target of our detection rule.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
