Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure

Gunra ransomware operators are exploiting vulnerabilities in Fortinet products to compromise critical infrastructure, with a particular focus on exfiltrating large amounts of data from Microsoft services. This targeted approach allows the attackers to remain stealthy, making it challenging for organizations to detect and respond to the threats. The use of Fortinet flaws, potentially including unpatched CVEs, enables the Gunra actors to gain initial access to the targeted systems. US and Korean agencies have issued warnings about the threats posed by Gunra, emphasizing the need for operational resilience planning to mitigate the risks. The fact that Gunra is targeting Microsoft services highlights the sector-specific risk associated with ransomware attacks¹. This underscores the importance of proactive measures to prevent and respond to such attacks, making it essential for practitioners to prioritize robust security protocols and incident response strategies. The exploitation of Fortinet flaws by Gunra ransomware operators has significant implications for the security of critical infrastructure, so what matters most is the urgent need for organizations to review and strengthen their defenses against these types of attacks.