US and South Korea Warn of Gunra Ransomware as 51 Organizations Hit via Fortinet Flaws

Cybersecurity and intelligence agencies from the US and South Korea jointly warned Monday that Gunra, a ransomware-as-a-service operation built on leaked code from the notorious Conti gang, has struck at least 51 organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific — breaching hospitals, government agencies and financial institutions by exploiting unpatched Fortinet firewall products and demanding ransoms that in most documented cases exceeded $10 million.

Two Authentication-Bypass Flaws, Years Unpatched

The advisory, designated AA26-222A under CISA's StopRansomware program, attributes initial access primarily to two authentication-bypass vulnerabilities in Fortinet's FortiOS and FortiProxy: CVE-2024-55591 (CVSS 9.6, critical) and CVE-2025-24472 (CVSS 8.1, high). Both are on CISA's Known Exploited Vulnerabilities catalog, and patches have been available since early 2025 — meaning most documented victims were running internet-exposed management interfaces that were never updated.

Gunra, which recruits penetration testers to sell initial access to affiliates in exchange for profit shares, runs a double-extortion scheme with a Tor leak site and can encrypt up to 9 terabytes of data using ChaCha20 and Salsa20 stream ciphers, according to The Hacker News. Researchers point to technical overlaps with North Korean-linked tooling, though the advisory stops short of attributing state sponsorship.

Linux Victims Can Recover Files Without Paying

The most urgent finding for defenders: Breakglass Intelligence confirmed that Gunra's Linux builds generate ChaCha20 key material using musl-libc's rand() function seeded by the Unix timestamp — a generator with only about 256 possible seed values per second of encryption. For a realistic one-hour encryption window, that is roughly 3,600 seeds to test, trivially small for any modern computer. Files encrypted by the Linux variant (the .GNRA extension) can be recovered without paying if timestamps are preserved; the Windows variant uses CryptGenRandom and is not affected.

The advisory arrives as ransomware targeting industrial and critical infrastructure organizations hit record levels: Dragos identified 1,140 industrial ransomware incidents globally in the second quarter of 2026, up 12 percent from 1,020 in the first quarter, with Gunra attributed to at least four of them — up from eight in Q1's pace, suggesting acceleration against industrial targets.