Dark ReadingRob Wright
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
Part of the CVE-2024-55591 story · since 19 Mar
- Thu 19 Mar, 15:04 UTC. The Hacker News, first report. ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More. Cites a CVE in CISA KEV.
- Wed 13 May, 13:31 UTC. Check Point, its first report on the story. Gentlemen RaaS leak reveals 332 victims, internal chats exposed. Cites a CVE in CISA KEV.
- Tue 11 Aug, 22:01 UTC. Dark Reading, its first report on the story. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA. Cites a CVE in CISA KEV. This article, 3rd of 5.
- Fri 4 Sep, 13:22 UTC. SecurityOnline, its first report on the story. Gentlemen Ransomware Storms Networks Through Fortinet VPNs. Cites a CVE in CISA KEV.
- Tue 20 Oct, 12:30 UTC. SOCRadar, its first report on the story. Japan’s October Breach Wave Exposes Millions of Customer Records. Cites a CVE in CISA KEV.
The Gunra ransomware gang, utilizing known vulnerabilities in Fortinet products, is successfully targeting critical infrastructure and government entities globally. The group employs sophisticated double-extortion tactics and is leveraging leaked source code from the defunct Conti gang. Key vulnerabilities include authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) that allow attackers to gain super admin access and circumvent multi-factor authentication (MFA).
Gunra's operations extend to a wide range of sectors including healthcare and finance, and they have a structured Ransomware-as-a-Service (RaaS) model that attracts less-skilled cybercriminals. The advisory from U.S. and South Korean government agencies stresses the urgency for organizations to patch these vulnerabilities and implement robust backup strategies to combat ransomware threats.
How the story developed
5 articles from 5 outlets since 19 Mar. Quiet since 20 Oct. This was the 3rd report, 145 days after the first.
- Thu 19 Mar, 15:04 UTC. The Hacker News, first report. ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More. Cites a CVE in CISA KEV.
- Wed 13 May, 13:31 UTC. Check Point, its first report on the story. Gentlemen RaaS leak reveals 332 victims, internal chats exposed. Cites a CVE in CISA KEV.
- Tue 11 Aug, 22:01 UTC. Dark Reading, its first report on the story. Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA. Cites a CVE in CISA KEV. This article, 3rd of 5.
- Fri 4 Sep, 13:22 UTC. SecurityOnline, its first report on the story. Gentlemen Ransomware Storms Networks Through Fortinet VPNs. Cites a CVE in CISA KEV.
- Tue 20 Oct, 12:30 UTC. SOCRadar, its first report on the story. Japan’s October Breach Wave Exposes Millions of Customer Records. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 5 articles as a listHide the list
- Thu 19 MarDay 01
- ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More15:04 · The Hacker News · First report · Exploited CVE · Known exploited CVE
Quiet for 8 weeks
Wed 13 MayDay 551- Gentlemen RaaS leak reveals 332 victims, internal chats exposed13:31 · Check Point · Picked up again · Known exploited CVE
Quiet for 13 weeks
Tue 11 AugDay 1451- Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA22:01 · Dark Reading · Picked up again · Known exploited CVE · This article, 3rd of 5
Quiet for 3 weeks
Fri 4 SepDay 1691- Gentlemen Ransomware Storms Networks Through Fortinet VPNs13:22 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 7 weeks
Tue 20 OctDay 2151- Japan’s October Breach Wave Exposes Millions of Customer Records12:30 · SOCRadar · Picked up again · Known exploited CVE