Gunra ransomware: what AA26-222A actually gives your detection engineers

Six agencies put their names to AA26-222A on 10 August 2026: the FBI, CISA, the Defense Cyber Crime Center, the NSA, the US Secret Service and the Republic of Korea's National Police Agency. The subject is Gunra, a double-extortion family the advisory says emerged in April 2025 and is derived from the leaked Conti source code.

The way in was not novel. Gunra actors exploited two Fortinet authentication bypasses, CVE-2024-55591 and CVE-2025-24472. CISA added the first to the Known Exploited Vulnerabilities catalogue on 14 January 2025 with a federal remediation deadline of 21 January, and the second on 18 March 2025 with a deadline of 8 April. Both entries are flagged in the catalogue as known ransomware campaign vectors.

That is the familiar part, and it is not the interesting part. What matters is what the actors did once through the perimeter, because almost none of it looks like malware to an endpoint agent.

The account nobody audits

On vulnerable FortiOS devices, the advisory says the actors abused scheduled tasks to create a persistent user called forticloud-sync with super-user privileges and a hard-coded password. Read that name again. It is designed to survive a human reviewing an account list, because it looks exactly like a vendor service account somebody else set up.

Separately, the agencies describe Gunra obtaining an administrator account on an SSL-VPN appliance using default credentials — which worked because account lockout controls were not in place. The actors then changed the account configuration to bypass the mandatory password change the appliance would otherwise have enforced.

Persistence that outlives your incident response

Two mechanisms in this advisory deserve more attention than they will get.

The first is tunnelling. The actors downloaded OpenSSH from an external server they controlled and used it to link compromised systems together. Legitimate binary, legitimate protocol, encrypted channel.

The second is worse. The agencies report that Gunra altered files in a victim's VDI authentication server portal so that a specific attacker-chosen one-time password always succeeded. That is a permanent MFA bypass built into the authentication service itself, and it does not care whether you rotate credentials or re-enrol tokens afterwards.

A backdoor living inside your MFA server's own logic will never appear in an indicator sweep. It appears as a successful, policy-compliant login by a real user.

Credentials, movement, and tens of terabytes

Credential access is conventional and well documented here: Mimikatz, and Impacket's secretsdump.py run against compromised domain controllers to pull NTDS hashes. Movement used psexec.py and smbclient.py over SMB admin shares, plus pass-the-hash and pass-the-ticket with the stolen material. Stolen VDI session information let them pivot by RDP into Active Directory servers and IT workstations.

One technique is less common and worth a hunt of its own. The advisory says the actors manipulated the traffic control functionality of an SSL-VPN appliance to collect credentials and session information as users transmitted them, then used stolen session cookies for hijacking. Your VPN concentrator was the collection point.

For exfiltration, the agencies name a custom executable, main.exe, used to pull data out of Microsoft OneDrive and SharePoint. Archives built with 7-Zip, WinRAR and RClone went to Mega. The volume reached tens of terabytes at one victim, according to the advisory. The wider toolset listed is almost entirely legitimate software: AnyDesk, Google Remote Desktop, MobaXterm, FileZilla, DBeaver, Amass, Visual Studio Code and Slack, alongside Sliver for command and control.

The locker, and the flaw in the Linux build

The Windows encryptor uses ChaCha20 with RSA-4096 and a multi-threaded design that encrypts files in parallel. It walks drive letters A through Z using FindFirstFileW and FindNextFileW, skips system directories and system-critical extensions, and avoids re-encrypting files it has already processed. Encrypted files take the .ENCRT extension; .CRYPT appeared in July 2025 samples. A static ransom note named R3ADM3.txt is dropped into each affected directory.

Shadow copies go via WMIC:

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{guid of shadowcopy}'" delete

The binary calls IsDebuggerPresent to frustrate analysis. The operators timed reconnaissance for the late night and early morning window. They deleted backup and archived data at both the primary data centre and the disaster recovery site.

And then the mistake. The Linux variant, which appends .GNRA, seeds its pseudorandom number generator with srand(time(NULL)). The agencies state that keys can be mathematically reconstructed from file timestamps. If you are hit by the Linux build, recovery may be possible without paying — provided nobody has destroyed the timestamps.

Turning an advisory into coverage

Here is the part that applies well beyond Gunra. CISA's own #StopRansomware alerts page currently lists three joint family advisories across 2025 and 2026: Medusa in March 2025, Interlock in July 2025, and now Gunra. This is not a firehose. It is a scarce, free, vendor-neutral, government-validated description of a real intrusion chain, mapped to more than thirty MITRE ATT&CK techniques, with a section at the end telling you to test your controls against each one. Most security teams skim the IOC block, paste the hashes into a blocklist, and close the tab.

The IOCs are the least durable thing in the document. Infrastructure rotates; behaviour does not. Work the mapping instead:

1. Extract every ATT&CK technique from the advisory into a sheet, one row each. Add a column for the detection you believe covers it and a column for the log source that detection depends on.
2. Prove the log source exists before you claim the coverage. Perimeter appliance administrative audit logs, VDI authentication logs and SSL-VPN configuration change events are the three most commonly missing here, and all three are load-bearing for this campaign.
3. Write the specific hunts this advisory hands you free: new super-user accounts on FortiOS estate, especially names resembling vendor services; account lockout disabled on any VPN appliance; outbound SSH from servers that have no business making it; RClone or Mega destinations in egress telemetry.
4. Run the advisory's own validation loop — pick a technique, align the tooling meant to catch it, test it in production at scale, analyse what the tooling actually did, then tune. Repeat. The agencies spell this out; almost nobody does it.
5. File the gaps as tickets with the advisory ID in the title. An unlogged gap you noticed once is not coverage, and in six months nobody will remember why it mattered.

The control asks in the mitigations section map to CISA's Cross-Sector Cybersecurity Performance Goals: patching known exploited vulnerabilities (CPG 2.B), offline and segmented backups (3.I, 3.O, 1.C), reviewing directories for unrecognised accounts (2.A, 2.E), least privilege for admin accounts (3.G), MFA on webmail and VPNs (3.F), and restricting command-line and scripting permissions (3.G, 3.M). None of that is new advice. The value is that a specific, current intrusion now justifies each line to whoever holds your budget.

One operational instruction to take away ahead of everything else: if Linux or ESXi hosts are encrypted, preserve the encrypted files, their timestamps, the ransom notes and the system logs before anyone touches the recovery process. The advisory says key reconstruction depends on exactly that material. A well-meaning engineer who wipes and rebuilds to restore service faster may destroy the only route back that does not involve a negotiation portal and a five to seven day clock.