Full research report
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks
Executive assessment
The most important finding is that the Schneider Electric element of the headline is erroneous: CISA corrected CVE-2024-5559 to CVE-2024-55591, making both confirmed initial-access flaws Fortinet authentication bypasses. The official advisory directly attributes exploitation of CVE-2024-55591 and CVE-2025-24472 to Gunra actors, so this is confirmed campaign exploitation rather than inference from vulnerability scoring or generic threat reporting. The observed operation combines exposed-appliance compromise with credential theft, Impacket-enabled lateral movement, data exfiltration and encryption. Independent research supports Gunra's transition to an affiliate-driven service and cross-platform malware, while also indicating that some analysed Linux builds may be recoverable because of weak key generation. Defenders should prioritise exposed Fortinet upgrades and compromise assessment rather than treating Schneider Electric PowerLogic equipment as the evidenced entry point for this campaign.
What happened
On 10 August 2026, CISA, the FBI and partner agencies published a joint advisory describing Gunra ransomware incidents observed since April 2025 and the operation's expansion into ransomware-as-a-service in January 2026. The agencies confirmed that affiliates obtained initial access through Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472 before conducting data theft and encryption. An initial government notice and subsequent reporting mistakenly named Schneider Electric CVE-2024-5559; CISA corrected that identifier to Fortinet CVE-2024-55591.
Affected scope
The confirmed vulnerable products are Fortinet FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12. CVE-2025-24472 additionally requires Security Fabric to be enabled and prior knowledge of relevant device serial numbers. Gunra has targeted government and numerous critical-infrastructure and commercial sectors worldwide, including healthcare, finance, manufacturing, transport, utilities and professional services.
Technical assessment
Both confirmed vulnerabilities bypass authentication boundaries in FortiOS or FortiProxy and can yield super-administrator privileges, although CVE-2025-24472 has additional topology and serial-number prerequisites. The joint advisory describes post-compromise use of Impacket tools for Server Message Block lateral movement and credential dumping, followed by exfiltration and ransomware deployment. Gunra employs double extortion, but the evidence does not establish that every reported victim was compromised through these CVEs. CVE-2024-5559 is a physically accessed Schneider Electric relay weakness and does not match the observed internet-facing Fortinet attack path.
Recommended defensive actions
- Patch FortiOS and FortiProxy systems affected by CVE-2024-55591 or CVE-2025-24472, prioritising internet-facing VPN and firewall appliances.
- Inventory exposed Fortinet appliances and verify that installed releases fall outside the documented vulnerable ranges.
- Audit Fortinet and identity logs for unexpected super-administrator activity, configuration changes, new or reactivated accounts and anomalous VPN sessions.
- Hunt for unauthorised use of Impacket psexec.py, smbclient.py and secretsdump.py, suspicious OpenSSH tunnelling, remote desktop movement and deletion of access logs.
- Segment VPN infrastructure, virtual desktop infrastructure, domain controllers, database servers and network-attached storage to restrict lateral movement.
- Implement and test physically separate, offline immutable backups before relying on them for ransomware recovery.
Uncertainties and evidence gaps
- The public advisory does not disclose how many Gunra incidents used each Fortinet vulnerability or identify the affected organisations.
- Leak-site victim counts and geographic claims are not equivalent to independently verified compromises.
- No public proof-of-concept specifically tied to the reported Gunra initial-access activity was identified during this review.
- The reported recoverability weakness concerns analysed Linux builds and may not apply to Windows variants or later Gunra releases.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation by Gunra affiliates; no public proof-of-concept specific to these Gunra attack chains was identified.
The investigation began with a claim that Gunra exploited one Schneider Electric and one Fortinet flaw. The joint government advisory confirmed active Gunra exploitation but its corrected notice showed that the Schneider attribution resulted from a one-digit CVE error: both confirmed vulnerabilities affect Fortinet products. CVE records established the distinct authentication-bypass mechanisms and affected versions, while independent malware research corroborated Gunra's affiliate operation, cross-platform lockers and double-extortion capability.
- What event and exploitation claims did the supplied article make?Opened and reviewed the supplied report and followed its cited authority links.thehackernews.com ↗
The report attributed initial access to CVE-2024-5559 and CVE-2025-24472 and described a joint government warning about Gunra.
why This framed the central verification question but did not itself prove the CVE attribution.
- Did government authorities confirm Gunra exploitation and the broader campaign?Read the complete joint #StopRansomware advisory.cisa.gov ↗
CISA and partners confirmed observed Gunra exploitation of CVE-2024-55591 and CVE-2025-24472 in internet-facing Fortinet devices, followed by credential access, lateral movement, exfiltration and encryption.
why This primary source establishes active exploitation in this campaign and provides the strongest technical account.
- Was the Schneider Electric CVE attribution accurate?Reviewed CISA's accompanying press release and correction.cisa.gov ↗
CISA explicitly states that the original release mistakenly linked CVE-2024-5559 and should have linked CVE-2024-55591.
why The correction resolves the apparent Schneider Electric connection and changes the confirmed CVE set.
- What does CVE-2024-5559 actually affect?Opened its official CVE record.cve.org ↗
CVE-2024-5559 is a Schneider Electric relay weakness requiring a specially crafted reset token at the device's front panel and has a physical attack vector.
why Its product, access requirement and mechanism contradict the reported internet-facing Gunra initial-access path, so it was excluded.
- What are the characteristics of the corrected first vulnerability?Opened the official CVE-2024-55591 record.cve.org ↗
The record describes a critical remote authentication bypass in FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12 that can grant super-administrator privileges through the Node.js WebSocket path.
why This matches the vendor, exposure and privilege impact described by the joint advisory.
- How does CVE-2025-24472 differ and what scope does it have?Opened the official CVE-2025-24472 record.cve.org ↗
It affects the same documented release ranges but uses crafted Security Fabric CSF proxy requests and requires Security Fabric plus knowledge of device serial numbers.
why These prerequisites prevent treating the two authentication bypasses as interchangeable and refine exposure assessment.
- Is Gunra an established operation beyond the advisory's individual cases?Reviewed an independent analysis of the affiliate programme and Windows locker.cloudsek.com ↗
CloudSEK reported discovery of Gunra's affiliate programme in January 2026 and analysed a configurable Windows locker using ChaCha20 and RSA-4096.
why This independently corroborates the ransomware-as-a-service transition and malware capability without proving any particular intrusion.
- What is known about Gunra's Linux variant and recovery prospects?Reviewed Breakglass Intelligence's Linux binary analysis.intel.breakglass.tech ↗
Researchers identified Linux builds across several architectures and reported weak time-seeded key generation that can permit file recovery from the analysed variant.
why This provides a potential incident-response avenue but must not be generalised to Windows or unexamined builds.
- How extensive are Gunra's public victim claims?Checked the current Gunra leak-site monitoring profile.ransomware.live ↗
The record showed 51 claimed victims across 27 countries, with activity from April 2025 through August 2026.
why It supports continued operational activity and broad geographic reach, while remaining claim-based rather than proof of each compromise.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 17 registered sources supplied useful evidence (2 primary, 13 corroborating, 2 contextual and 0 PoC/exploit references). 44 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1665 records | Primary evidence4 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok15 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok680 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Context1 matched items | Provided lower-confidence OSINT context matched to an explicit CVE. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5323 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 16 opened outside the registered collection
Vulnerability & exploitation2
OSINT / dark-web chatter1
Vendor & gov advisories5
Joint government advisory confirms Gunra exploitation of two Fortinet authentication-bypass vulnerabilities and provides detection and mitigation guidance.
CISA's corrected notice states that CVE-2024-55591, not Schneider Electric CVE-2024-5559, was exploited.
Confirms the critical FortiOS and FortiProxy authentication bypass, affected versions and remote super-administrator impact.
Confirms the Fortinet Security Fabric authentication bypass, prerequisites, affected versions and super-administrator impact.
CISA identifies the catalogue as the authoritative record of vulnerabilities exploited in the wild.
OSINT / dark-web chatter1
Tracks 51 claimed victims across 27 countries between April 2025 and August 2026; leak-site claims remain actor-controlled reporting.
Analysis & research3
Initial reporting repeated the subsequently corrected CVE-2024-5559 attribution but linked to the authoritative joint advisory.
Documents the January 2026 affiliate programme and analyses Gunra's Windows locker and hybrid encryption design.
Analyses multi-architecture Linux builds and reports that weak key generation may permit recovery from that particular variant.