Feds warn Gunra ransomware is exploiting known bugs to hit critical infrastructure

Cybersecurity agencies in the United States have issued a warning to critical infrastructure operators about their internet-facing systems being vulnerable to Gunra ransomware. This ransomware variant, which first emerged in 2025, exploits known vulnerabilities in Fortinet's FortiOS and FortiProxy to gain unauthorized access to networks. Gunra has been observed targeting various sectors, including healthcare, financial services, government, and professional services, among others.

The ransomware's operators use a double-extortion tactic, where they first steal sensitive data and then encrypt critical systems. They demand payment for a decryption key and a promise not to publish the stolen information. The negotiation process occurs on a Tor-based portal, leaving potential victims with a five to seven-day window to comply before the data is published online.

Experts attribute the persistence of Gunra to its ability to adapt and exploit new vulnerabilities. Trend Micro first identified the ransomware in April 2025, initially targeting Windows systems but later discovering a Linux version with enhanced capabilities. This new version can execute up to 100 encryption threads simultaneously, support partial encryption of individual files, and store RSA-encrypted keys in separate files for added complexity.

The Federal Bureau of Investigation, the National Security Agency, the Secret Service, and allied agencies from the United States and South Korea are warning organizations to patch their internet-facing systems promptly, secure VPN gateways and Remote Desktop Protocol (RDP) access with multi-factor authentication, segment their networks, and maintain offline, immutable backups. These measures can help mitigate the risks associated with Gunra ransomware and protect critical infrastructure from potential disruptions.