CTIPilot

Gunra

actor · actor:gunra

Double-extortion ransomware-as-a-service that the FBI first observed in April 2025 and which the authoring agencies of joint advisory AA26-222A assess to be based on, or significantly influenced by, the Conti source code leaked in 2022. It formalised an affiliate programme on criminal forums as of January 2026, supplying a management panel, a configurable builder and cross-platform lockers, and also operates under the name Golden Community. Initial access is primarily exploitation of known FortiOS and FortiProxy authentication-bypass flaws on internet-facing appliances; documented tradecraft includes creating a persistent super-user account on the exploited firewall, sniffing VDI authentication traffic from an SSL-VPN appliance, and editing a VDI authentication portal's processing files so one attacker-chosen one-time-password value always validates. The Linux encryptor seeds its keys with the system clock, which the advisory states lets defenders reconstruct keys from file timestamps (FBI/CISA/DC3/NSA/USSS/KNPA, 2026-08-10).

Aliases: Golden Community

Coverage timeline
2
first 2026-08-11 → last 2026-08-15
Peak priority
high
1 high · 1 notable
Sources cited
7
4 hosts
Sections touched
2
deep-dive, trending-vulnerabilities
Co-occurring entities
8
see Co-occurring entities below
ATT&CK techniques
38
pinned v19.2 · see below
2026-08-112 appearances2026-08-15

Hunting pivots

ATT&CK techniques
T1190 ×2T1003T1003.003T1005T1021.001T1021.002T1040T1047T1048T1049T1059.003T1070.003T1078T1078.001T1078.002T1083T1098T1105T1106T1114T1133T1486T1490T1530
Affected products
Fortinet FortiClientFortinet FortiManagerFortinet FortiManager CloudFortinet FortiOSFortinet FortiProxyFortinet FortiWeb
Tags
auth-bypass ×2vulnerabilities ×2actively-exploitedidentityno-patchorganized-crimepatch-availablepre-authransomwarerce

ATT&CK techniques

38 techniques observed across 2 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Execution TA0002

T1047Windows Management Instrumentation×1

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1106Native API×1

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1098Account Manipulation×1

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1098Account Manipulation×1

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Stealth TA0005

T1070.003Indicator Removal: Clear Command History×1

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1678Delay Execution×1

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1679Selective Exclusion×1

Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Defense Impairment TA0112

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×1

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1003.003OS Credential Dumping: NTDS×1

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1040Network Sniffing×1

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1555Credentials from Password Stores×1

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · ATT&CK page ↗

Discovery TA0007

T1040Network Sniffing×1

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1049System Network Connections Discovery×1

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1083File and Directory Discovery×1

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1021.002Remote Services: SMB/Windows Admin Shares×1

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1550.002Use Alternate Authentication Material: Pass the Hash×1

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1550.003Use Alternate Authentication Material: Pass the Ticket×1

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1114Email Collection×1

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1530Data from Cloud Storage×1

Adversaries may access data from cloud storage.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-08-15/fortiweb-radius-wildcard-bypass-fortimanager-fgfm · ATT&CK page ↗

T1560Archive Collected Data×1

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Exfiltration TA0010

T1048Exfiltration Over Alternative Protocol×1

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1567Exfiltration Over Web Service×1

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1490Inhibit System Recovery×1

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

T1657Financial Theft×1

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Story timeline

  1. 2026-08-15CVE-2026-26035, FortiWeb: one non-default RADIUS admin setting turns any username and password into a valid GUI/CLI login, alongside an FGFM impersonation bug and a FortiClient flaw reachable by anyone who can answer a laptop's DNS
    trending-vulnerabilitiesFortinet patches a FortiWeb admin-login bypass gated on a 'Wildcard' option, an FGFM impersonation flaw, and a FortiClient RCE reached via crafted DNS
  2. 2026-08-11Gunra ransomware-as-a-service: a joint six-agency advisory documents FortiOS edge exploitation, a persistent MFA backdoor built from one fixed OTP value, and a Linux encryptor whose keys can be reconstructed
    deep-diveSix agencies publish the Gunra RaaS playbook, edge exploitation, an OTP-value MFA backdoor, and a recoverable Linux key

Where this entity is cited

  • deep-dive1
  • trending-vulnerabilities1

Source distribution

  • fortiguard.com4 (57%)
  • cisa.gov1 (14%)
  • intel.breakglass.tech1 (14%)
  • securityweek.com1 (14%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (7)

Entries about Gunra (2)

2026-08-15 · view entry permalink →

NOTABLECVE-2026-26035 +3NATOA2

CVE-2026-26035, FortiWeb: one non-default RADIUS admin setting turns any username and password into a valid GUI/CLI login, alongside an FGFM impersonation bug and a FortiClient flaw reachable by anyone who can answer a laptop's DNS

Fortinet issued patches for eight vulnerabilities across its products on 2026-08-12 (SecurityWeek, 2026-08-13). Four of the flaws in that batch matter to a defender's next week. The most consequential is CVE-2026-26035 (CVSS 8.8, CWE-287): where FortiWeb's Remote RADIUS Type Admin authentication is configured with specific, non-default settings, a remote unauthenticated attacker can log into the FortiWeb GUI or CLI with a random username and password (Fortinet PSIRT, 2026-08-12). The setting in question is named in the advisory's own workaround: the Wildcard option on a Remote Type administrator account, reached in the GUI under System > Administrators. The affected branches, read from Fortinet's CSAF record rather than the advisory's rendered table, are FortiWeb 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12 and 7.0.0 through 7.0.12. Released fixes exist for three of those five: 8.0.3, 7.6.7 and 7.4.12. The 7.2 and 7.0 branches are answered only by builds the record marks as upcoming (7.2.13 and 7.0.13) so an estate on either has no patch to install today and the Wildcard configuration check is its whole remediation.

CVE-2026-70468 (CVSS 7.3, CWE-288) is the management-plane counterpart: a remote unauthenticated attacker holding a valid certificate can impersonate any FortiGate managed by a FortiManager that has a specific CLI option set, via crafted FGFM protocol requests (Fortinet PSIRT, 2026-08-12). The option is fgfm-peercert-withoutsn, and disabling it is the vendor's stated workaround. Affected are FortiManager 7.6.1, 7.4.3 through 7.4.5 and 7.2.5 through 7.2.9 plus the corresponding FortiManager Cloud versions, fixed in 7.6.2, 7.4.6 and 7.2.10; FortiManager 8.0 is listed as not affected. CVE-2026-70466 (CVSS 4.8, CWE-184) is an incomplete list of disallowed inputs in the FortiWeb WAF that lets an unauthenticated attacker bypass policies via specifically crafted requests (Fortinet PSIRT, 2026-08-12), a lower score, but a WAF that can be walked past is a compensating control that has stopped compensating. Its version data is the one to read carefully: 8.0.0 through 8.0.2 are answered by 8.0.3 and 7.6.0 through 7.6.5 by 7.6.6, but the 7.4, 7.2 and 7.0 branches are all listed as affected at every version with no fixed build at all (migration is the only remediation, and Fortinet offers an interim virtual patch, FG-VD-10009598.0day, in FortiWeb signature database update FMWP 26.071) the concrete lever for the three branches with no fixed build.

The fourth flaw in the batch is the one that reaches past the data centre. CVE-2026-70465 (CVSS 7.3, CWE-120) is a buffer copy without checking the size of input in FortiClient for Windows that "may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets" (Fortinet PSIRT, 2026-08-12). The precondition is not a credential but a network position: anyone able to answer the endpoint's DNS queries (a hostile or compromised local network, a captive portal, an on-path attacker upstream of a home or hotel connection) can reach the code path. That is precisely the position a remote-working laptop puts itself in every time it joins an untrusted network before the VPN comes up, which makes this a teleworker-fleet problem rather than a server-patching one. FortiClient for Windows 7.4.0 through 7.4.3 upgrade to 7.4.4 and 7.2.0 through 7.2.11 upgrade to 7.2.12; the 8.0 branch is not affected. Fortinet's stated workaround is to disable application-based filtering in the FortiClient EMS remote-access profile's VPN tunnel settings. SecurityWeek notes Fortinet makes no mention of any of these vulnerabilities being exploited in the wild (SecurityWeek, 2026-08-13).

None of them is reported exploited: SecurityWeek records that Fortinet makes no mention of any of these vulnerabilities being exploited in the wild. What lifts them above the ordinary patch queue is that two of them are configuration-gated, which cuts both ways: an estate that never enabled the Wildcard option or fgfm-peercert-withoutsn is not exposed at all and needs only a routine upgrade, while one that did is exposed right now and can close the hole today with a settings change rather than a maintenance window. That makes the first task an inventory question, not a patching question, and it is answerable in minutes across a fleet. The certificate precondition on the FortiManager bug is worth reading precisely: it does not say a certificate issued to the impersonated FortiGate, and the advisory's own framing is an alternate-path authentication bypass, so a defender should treat any valid certificate the deployment would accept as sufficient rather than assuming device-specific binding.

Detection concepts, telemetry class first: in administrative authentication logs on FortiWeb, a successful GUI or CLI admin login for a username that does not exist in the backing RADIUS directory is the signature of this bypass being used, the login succeeds locally, so the discriminator is the mismatch between the accepted account and the identity store that was supposed to authorise it. In management-fabric telemetry on FortiManager, watch for FGFM session establishment from a source presenting a certificate whose subject does not correspond to the device serial the session claims, and for a managed FortiGate appearing to check in from an unexpected address or twice from different sources. Fortinet edge and management products have a sustained recent history of rapid post-disclosure weaponisation (this pipeline recorded a Gunra ransomware campaign abusing older FortiOS authentication-bypass flaws for initial access four days ago) so the interval between a published advisory and a working exploit is the planning assumption here, not the absence of exploitation today.

An Improper Authentication vulnerability [CWE-287] in the FortiWeb Remote Radius Type Admin Authentication configured with specific, non-default settings may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

Fortinet PSIRT, FG-IR-26-158 2026-08-12

An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate.

Fortinet PSIRT, FG-IR-26-160 2026-08-12

A buffer copy without checking size of input vulnerability [CWE-120] in FortiClient Windows may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets.

Fortinet PSIRT, FG-IR-26-156 2026-08-12
vulnerability15 Aug 04:56Zmulti-sourceOpen finding ↗
Sources: Fortinet PSIRT, FG-IR-26-158 · Fortinet PSIRT, FG-IR-26-160 · Fortinet PSIRT, FG-IR-26-157 · Fortinet PSIRT, FG-IR-26-156 · SecurityWeek

2026-08-11 · view entry permalink →

HIGHCVE-2024-55591 +1exploitedNATOA1

Gunra ransomware-as-a-service: a joint six-agency advisory documents FortiOS edge exploitation, a persistent MFA backdoor built from one fixed OTP value, and a Linux encryptor whose keys can be reconstructed

Six authorities (the FBI, CISA, the Department of Defense Cyber Crime Center, the NSA, the US Secret Service and the Republic of Korea's National Police Agency) published a joint #StopRansomware advisory on Gunra on 2026-08-10 (CISA et al., 2026-08-10). Gunra first appeared in April 2025 and is, in the authoring agencies' assessment, based on or significantly influenced by the Conti source code leaked in 2022; as of January 2026 it runs a structured affiliate programme advertised on criminal forums, supplying a management panel, a configurable builder, cross-platform lockers and affiliate documentation, and the FBI records the group also operating under the name Golden Community and recruiting penetration testers as initial-access brokers (CISA et al., 2026-08-10). The victim set on the group's leak site spans the Americas, Europe, the Middle East, Africa and Asia-Pacific, and the advisory names government services and facilities, utilities, healthcare, financial services, critical manufacturing and transport among the affected sectors, which is why this reads directly onto the European public-sector and critical-infrastructure estate, not only onto its Korean and American case studies.

Initial access is the edge appliance. The FBI observed Gunra obtaining access primarily by exploiting known vulnerabilities in internet-facing firewall and VPN appliances, specifically the FortiOS and FortiProxy authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472, both CWE-288 (CISA et al., 2026-08-10). The advisory points at the CVE records rather than restating affected versions, and it is explicit about what the exploitation buys: those two flaws let an actor abuse scheduled tasks on a vulnerable FortiOS firewall to create a new persistent super-user account named forticloud-sync carrying a hard-coded password (CISA et al., 2026-08-10). That account name is the cheapest hunt in this advisory: an appliance administrator enumeration that finds it has found an intrusion, and finding it after patching means the patch did not evict anyone. Separately, KNPA observed initial access through credential-exposure and SSH access-control weaknesses on internet-facing VPN gateways, and in one case through an SSL-VPN administrator account reachable with default credentials because no account-lockout control was configured.

The identity plane is where the intrusion becomes durable. After taking a network administrator's workstation and the SSL-VPN administrative console, the actors located an unused account with reach into both the internet-facing and internal networks and modified its configuration to bypass the mandatory password-change requirement, then used it (CISA et al., 2026-08-10). Against one victim they manipulated the traffic-control functionality of the SSL-VPN appliance itself to collect the credentials and session material users were sending to a corporate VDI authentication portal, then replayed the captured session cookies to impersonate legitimate users. Against the same victim they went one step further and edited the authentication-processing files on that VDI authentication portal server so that a specific attacker-chosen one-time-password value would always authenticate successfully, a standing MFA bypass rather than a stolen token. Credential access elsewhere is conventional but thorough: secretsdump.py against domain controllers to pull hashes out of NTDS for pass-the-hash and pass-the-ticket movement, psexec.py and smbclient.py over SMB for lateral movement, RDP into the VDI estate, and in one case theft of a symmetric key from a system access-control server that decrypted the stored passwords for every enterprise server account.

Behavioural shape, in telemetry terms. The operators work deliberately unsociable hours (the advisory records reconnaissance and internal activity concentrated between 22:00 and 06:00 to avoid administrator attention) and clear system and network access logs and shell command history behind them (CISA et al., 2026-08-10). Collection and exfiltration precede encryption: business documents, databases, personal data and internal mail are staged, a purpose-built executable pulls data out of Microsoft OneDrive and SharePoint, and for at least one victim compressed archives running to tens of terabytes went to a consumer file-sharing service, with 7-Zip, RClone and FileZilla among the tools observed on the group's own infrastructure. Recovery is attacked directly: volume shadow copies are deleted through WMI from a command shell before encryption, and against one victim backup and archive data was deleted at both the primary data centre and the disaster-recovery site, before and after deployment. The encryptor itself enumerates every drive letter through the native file-enumeration APIs, skips system directories and system-critical file extensions so the host stays bootable and the ransom note stays readable, checks for a debugger, and encrypts the surviving user data multi-threaded with ChaCha20 and RSA-4096, appending .ENCRT. Ransom notes land per directory and route victims to a Tor negotiation portal and an encrypted messenger with a five-to-seven-day clock.

The one piece of genuinely good news is a cryptographic mistake. The advisory records that as of March 2026 researchers identified a weakness in the Linux ELF variants, which append .GNRA: the encryption keys come from a weak pseudo-random generator seeded with the predictable srand(time(NULL)), and defenders may use that to mathematically reconstruct the keys from file timestamps and recover files without paying (CISA et al., 2026-08-10; original research at Breakglass Intelligence, 2026-03-12). This has an operational consequence that cuts against normal incident-response reflex: the advisory's own instruction, for a Gunra Linux incident where encryption has happened, is to preserve the encrypted files, their timestamps, the ransom notes and the system logs, because a rebuild-from-backup-and-move-on response throws away the timestamps the key reconstruction depends on. No such weakness is recorded for the Windows encryptor.

Detection concepts. Three of this actor's behaviours produce durable, vendor-neutral signal. In edge-appliance administrative logs and configuration audit trails, surface any newly created administrative or super-user account and any change that clears a mandatory-password-change flag on a dormant account; both are the advisory's stated persistence steps, and both are visible in configuration state rather than in transient telemetry. In authentication-server change control, file-integrity monitoring over the authentication-processing components of VDI, SSL-VPN and SSO portals is the only control that sees the OTP backdoor at all; it produces no failed logins, no impossible travel and no anomalous token, because from the portal's point of view the authentication genuinely succeeded. In endpoint process telemetry with parent lineage, the shadow-copy deletion is a command shell invoking the WMI command-line utility with a shadowcopy delete operation, and the credential-dumping and lateral-movement steps present as the Impacket family's characteristic service-creation-over-SMB and NTDS access patterns on domain controllers.

Triage: the tooling here is deliberately dual-use (remote-access and archiving utilities that administrators run legitimately every day) so presence alone is not the signal and the advisory says as much. The discriminators are contextual: the same remote-access agent installed on a host that has no help-desk ticket behind it, an archiving utility writing multi-gigabyte archives on a file server at 03:00, an account whose password-change requirement was cleared without a change record, and (the sharpest one) a successful multi-factor authentication in which the presented one-time-password value is identical across sessions or across users. Legitimate one-time codes never repeat; that is the whole property they exist for.

primarily through the exploitation of known vulnerabilities in internet-facing devices

create a new, malicious persistent user forticloud-sync with super user privileges and a hard-coded password

the Gunra actors modified authentication processing files on the corporate VDI authentication portal server to allow successful authentication when a specific, Gunra-designated one time password (OTP) value was entered, thereby enabling the continuous bypass of multi-factor authentication (MFA)

Defenders may leverage this to mathematically reconstruct the keys using file timestamps and recover files without paying the ransom.

Gunra ransomware appears to be based on, or significantly influenced by, the Conti ransomware source code leaked in 2022.

FBI, CISA, DC3, NSA, USSS and Republic of Korea National Police Agency 2026-08-10
threat11 Aug 04:36Zmulti-sourceOpen finding ↗
Sources: FBI, CISA, DC3, NSA, USSS and Republic of Korea National Police Agency · Breakglass Intelligence