As reported by Dark Reading, the Gunra ransomware-as-a-service operation is actively exploiting known Fortinet vulnerabilities in firewalls and VPN appliances while simultaneously defeating multi-factor authentication controls — a dangerous combination that is enabling successful intrusions against critical infrastructure targets.

Ransomware Alert: As reported by Dark Reading, the Gunra ransomware-as-a-service operation is actively exploiting known Fortinet vulnerabilities in firewalls and VPN appliances while simultaneously defeating multi-factor authentication controls — a dangerous combination that is enabling successful intrusions against critical infrastructure targets.

Why This Threat Demands Immediate Attention

The Gunra group represents a particularly concerning convergence of factors that security teams cannot afford to dismiss as routine ransomware noise. First, the group is leveraging leaked Conti source code — battle-tested ransomware tradecraft developed by one of the most prolific criminal enterprises in recent history. Organizations that assume "new" ransomware groups lack sophistication are making a dangerous miscalculation. Inherited Conti code means inherited operational maturity.

Second, and more strategically alarming, is the MFA bypass capability. For years, the security industry has positioned MFA as the single most impactful defensive control against credential-based attacks. When ransomware operators begin systematically defeating MFA at scale — particularly in combination with perimeter device exploitation — the defensive calculus for every organization shifts significantly.

The Fortinet Attack Surface Problem

Fortinet vulnerabilities have become a perennial favorite among ransomware operators and nation-state actors alike — and for understandable reasons. FortiGate firewalls and FortiVPN appliances sit at the absolute perimeter of enterprise and critical infrastructure networks. Compromising them doesn't just grant access; it grants privileged, persistent access with the ability to intercept credentials, manipulate traffic, and establish footholds that survive routine endpoint remediation efforts.

The persistent exploitation of "old" Fortinet flaws is itself a systemic indictment of patch management practices across critical infrastructure sectors. When threat actors find continued success with known, patched vulnerabilities, it tells us that a meaningful percentage of organizations are still running unpatched perimeter devices — months or even years after fixes were made available. This is not a technology failure; it is a process and governance failure.

Shield53 Perspective: The combination of a known-vulnerable network perimeter device and a defeated MFA control effectively eliminates two of the most commonly cited defensive layers in a typical security architecture. Organizations must stop treating these controls as checkboxes and start validating their actual effectiveness.

Who Is Most at Risk

Who Is Most at Risk
Critical infrastructure operators — energy, water, manufacturing, and healthcare — that rely heavily on Fortinet appliances for remote access and perimeter defense
Mid-market enterprises lacking dedicated vulnerability management programs or mature patch SLAs for network devices
Organizations using SMS-based or push-notification MFA, which are most susceptible to bypass techniques including SIM-swapping, MFA fatigue attacks, and adversary-in-the-middle (AiTM) proxies
Managed Service Providers (MSPs) running Fortinet infrastructure on behalf of multiple clients — a single compromise can cascade across dozens of downstream organizations

Understanding the MFA Bypass Dimension

It's worth being precise about what "MFA bypass" means in practice, as the term covers several distinct techniques with different mitigations. Gunra and similar groups typically leverage one or more of the following: AiTM phishing frameworks (such as Evilginx or Modlishka) that intercept session tokens in real time; MFA fatigue/push bombing attacks that overwhelm users into approving fraudulent authentication requests; or exploitation of the network device itself to harvest valid, authenticated session tokens directly — bypassing MFA entirely at the protocol level.

The last technique is especially relevant here. When an attacker compromises a Fortinet VPN appliance through an unpatched vulnerability, they may be able to extract active session cookies or manipulate authentication flows without ever needing to interact with the MFA layer. This is why patching the perimeter device is not optional — it is the prerequisite to every other defensive control working as intended.

Shield53 Recommendations

Immediate Actions

  • Audit all Fortinet devices immediately. Run an inventory of every FortiGate, FortiVPN, and FortiProxy instance in your environment. Cross-reference firmware versions against Fortinet's published security advisories. Any device running software with known critical or high-severity CVEs should be treated as a priority-zero patching task.
  • Review Fortinet PSIRT advisories for currently tracked CVEs, particularly those related to SSL-VPN authentication bypass and remote code execution. Key historical CVEs to validate patching status include CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.
  • Rotate all credentials associated with Fortinet admin interfaces and VPN accounts. Assume that any long-lived credentials on unpatched or recently patched devices may have been harvested.
  • Upgrade MFA to phishing-resistant standards. FIDO2/WebAuthn hardware keys (YubiKey, Titan Key) or certificate-based authentication are the only MFA mechanisms that reliably defeat AiTM-style bypasses. Begin migrating away from push-based MFA for privileged and remote access use cases.
  • Enable MFA number matching and additional context on Microsoft Authenticator, Duo, and similar platforms as an interim measure to combat push fatigue attacks.
  • Hunt for indicators of Conti-lineage TTPs in your environment: double extortion staging behaviors, use of Cobalt Strike or Brute Ratel C2, lateral movement via Windows Management Instrumentation (WMI), and large-volume data staging prior to encryption.

Longer-Term Strategic Actions

  • Implement a formal patch SLA policy that mandates critical patches on internet-facing network devices within 72 hours of vendor release.
  • Segment critical infrastructure networks so that VPN termination points cannot directly reach operational technology (OT) or production environments without additional authentication and inspection.
  • Subscribe to Fortinet's PSIRT notification service and CISA's Known Exploited Vulnerabilities (KEV) catalog alerts to receive proactive notification of actively exploited flaws.
  • Consider a third-party red team exercise specifically scoped to perimeter device exploitation and MFA bypass techniques to validate your actual defensive posture.

Gunra may be a newer name in the ransomware ecosystem, but the tools, techniques, and targets they've chosen reflect a calculated, experienced operational approach. The organizations that treat this as a routine threat advisory — rather than an urgent call to validate perimeter hygiene — are the ones most likely to appear in the next wave of victim disclosures.