Gunra Ransomware Exploits Fortinet & Schneider Electric Flaws in Global Attacks

Introduction

A coordinated alert issued by cybersecurity authorities in the United States and South Korea has pulled back the curtain on a aggressive ransomware operation dubbed Gunra. The campaign distinguishes itself by weaponizing unpatched vulnerabilities in widely deployed enterprise hardware—specifically Fortinet FortiOS SSL-VPN appliances and Schneider Electric industrial control systems—to gain initial access to high-value networks. The advisory confirms active exploitation across healthcare, financial services, government facilities, and professional nonprofit sectors worldwide.

Unlike opportunistic spray-and-pray campaigns, Gunra operators demonstrate deliberate targeting of critical infrastructure, suggesting either nation-state alignment or a highly organized criminal enterprise with strategic intent. The joint nature of the advisory—spanning CISA, the FBI, and South Korea's National Intelligence Service—underscores the severity and cross-border implications of this threat.

Attack Chain: From Perimeter Exploit to Domain Dominance

The Gunra intrusion lifecycle follows a disciplined progression that security teams should map against their detection coverage:

• Initial Access: Exploitation of CVE-2022-42475 (FortiOS SSL-VPN heap-based buffer overflow) and CVE-2023-27989 (Schneider Electric EcoStruxure Operator Terminal Expert path traversal) provides footholds in both IT and OT environments.
• Credential Harvesting: Post-exploitation tooling dumps LSASS memory and extracts stored VPN credentials, enabling lateral movement without triggering traditional malware alerts.
• Privilege Escalation: Attackers leverage Kerberos delegation misconfigurations and vulnerable drivers (BYOVD) to elevate from standard user to Domain Admin within hours.
• Persistence Mechanisms: Scheduled tasks, WMI event subscriptions, and modified Group Policy Objects ensure survival across reboots and credential rotations.
• Data Staging & Exfiltration: Critical databases and file shares are compressed using legitimate utilities (7-Zip, Rclone) before exfiltration to actor-controlled cloud storage.
• Encryption & Extortion: A custom AES-256 + RSA-4096 encryptor appends .gunra extensions. Ransom notes reference stolen data leaks on a dedicated TOR blog, doubling pressure on victims.

Why Critical Infrastructure Is the Primary Target

The sector selection is not random. Healthcare and public health organizations often run legacy medical devices that cannot be patched without vendor certification cycles. Financial services maintain complex hybrid environments where OT/IT convergence creates blind spots. Government facilities frequently operate end-of-life hardware due to procurement delays. Professional and nonprofit services—often overlooked—serve as supply chain entry points to larger targets.

Gunra operators exploit this reality: they know patching cadence in these sectors lags behind vulnerability disclosure by months, sometimes years. The dual exploitation of Fortinet (IT perimeter) and Schneider Electric (OT edge) suggests intelligence gathering prior to engagement—attackers understand the victim's architecture before striking.

Detection Gaps Most Organizations Miss

Standard EDR signatures catch known ransomware binaries, but Gunra's living-off-the-land approach bypasses them. Key detection opportunities include:

• Anomalous certutil.exe or bitsadmin.exe usage downloading payloads from internal IPs
• Sudden spikes in LDAP queries from non-admin workstations—indicative of Active Directory reconnaissance
• New scheduled tasks created by SYSTEM running PowerShell with encoded commands
• Volume Shadow Copy deletion via vssadmin.exe delete shadows /all /quiet—a reliable pre-encryption indicator
• Outbound connections to newly registered domains (< 30 days old) over non-standard ports

Network traffic analysis (NTA) and user behavior analytics (UEBA) remain underutilized but critical for catching this campaign early.

Immediate Mitigation Steps for At-Risk Organizations

Patching the exploited CVEs is necessary but insufficient. A layered response should include:

1. Enforce MFA on all VPN and remote access points—including service accounts and break-glass credentials.
2. Segment OT networks with unidirectional gateways; disable Schneider Electric programming interfaces unless actively commissioned.
3. Audit Kerberos delegation and remove unconstrained delegation from service accounts.
4. Deploy canary tokens in sensitive file shares to trigger alerts on mass access or encryption attempts.
5. Test offline backup restoration weekly—ransomware negotiators increasingly target backup repositories first.
6. Conduct tabletop exercises simulating Gunra's specific TTPs (MITRE ATT&CK: T1190, T1003, T1068, T1486, T1490).

Conclusion

The Gunra ransomware campaign is a wake-up call that critical infrastructure remains dangerously exposed to known vulnerabilities. The joint US-South Korea advisory isn't just a warning—it's a roadmap for defenders who choose to act. Patching Fortinet and Schneider Electric flaws is the baseline; building detection for post-exploitation behavior, enforcing identity-centric segmentation, and rehearsing response under pressure are what separate resilience from headlines.

As threat actors continue blending criminal profit motives with strategic targeting, the line between cybercrime and cyberwarfare blurs. Organizations that invest in continuous threat exposure management—not periodic scans—will be the ones still operating when the next variant emerges. Grivyonx Cloud's AI-driven attack surface intelligence and automated response orchestration help security teams close the gap between vulnerability disclosure and operational remediation, turning intelligence into action before adversaries capitalize on delay.