Gunra is a ransomware-as-a-service (RaaS) family first observed in April 2025. The ransomware is based on leaked Conti source code and has evolved into a double-extortion operation targeting organizations across multiple regions and industries.
Gunra targets both Windows and Linux systems and combines data theft with high-speed file encryption. The ransomware uses ChaCha20 for file encryption and RSA-4096 to protect the encryption key material.
Key Highlights
- Gunra is also known as Golden Community.
- The ransomware is based on leaked Conti source code.
- Windows and Linux variants have been observed.
- Files are encrypted using ChaCha20 with RSA-4096.
- Encrypted files receive the
.ENCRTextension. - Attackers exploit CVE-2024-55591 and CVE-2025-24472 against vulnerable FortiOS/FortiProxy devices.
- Attackers have been observed creating a persistent account named
forticloud-sync. - Gunra operators use Impacket tools including
psexec.py,smbclient.py, andsecretsdump.py. - Attackers steal documents, databases, PII, and internal email before encryption.
- Volume Shadow Copies and backup infrastructure may be targeted to prevent recovery.
Initial Access
Gunra actors have been observed exploiting internet-facing firewalls and VPN appliances.
Two important vulnerabilities associated with the activity are:
- CVE-2024-55591
- CVE-2025-24472
The vulnerabilities can be abused to create a persistent superuser account named forticloud-sync on vulnerable FortiOS environments.
Organizations should prioritize patching internet-facing FortiOS and FortiProxy appliances and investigate unexpected administrator-account creation.
Persistence and Lateral Movement
After gaining access, Gunra operators use legitimate administration and remote-access mechanisms to move through the environment.
Observed techniques include:
- SMB-based lateral movement
- Impacket
psexec.py - Impacket
smbclient.py - OpenSSH tunneling
- RDP-based movement
- Account manipulation
- Compromised VPN accounts
Attackers have also been observed pivoting into virtual desktop infrastructure and Active Directory environments.
Credential Access
Gunra operators target authentication material that can provide access to additional systems.
Observed activity includes:
- NTDS database dumping using
secretsdump.py - Pass-the-Hash activity
- Pass-the-Ticket activity
- Theft of stored encryption keys
- Modification of authentication mechanisms to bypass MFA
Data Collection and Exfiltration
Before deploying the ransomware encryptor, affiliates may collect sensitive organizational information.
Targeted data includes:
- Business documents
- Databases
- Personally identifiable information (PII)
- Internal email
- Enterprise credentials
Tools observed in the activity include 7-Zip, WinRAR, RClone, and FileZilla.
Attackers have also used cloud services and file-sharing platforms to move stolen data. Reported exfiltration volumes have reached tens of terabytes.
Ransomware Encryption
The Windows variant uses native Windows APIs such as FindFirstFileW and FindNextFileW to enumerate files and directories across accessible drives.
The encryptor operates using multiple threads, allowing it to process multiple files simultaneously.
Gunra uses:
ChaCha20 + RSA-4096
The Linux variant provides configurable encryption options, including:
- Number of encryption threads
- Target file extensions
- Encryption ratio
- Maximum encryption size
The Linux variant can run up to 100 encryption threads and process files in 1 MB chunks.
Encrypted files receive the:
.ENCRT
extension.
A ransom note named R3ADM3.txt is also written to affected directories.
Inhibiting System Recovery
Gunra attempts to prevent victims from recovering encrypted data by deleting Volume Shadow Copies.
Attackers have also been observed targeting backup and archived data on backup infrastructure.
This makes reliable, isolated and immutable backups particularly important for defending against the threat.
Detection and Hunting Opportunities
Security teams should monitor for:
- Creation of unexpected privileged accounts such as
forticloud-sync - Authentication changes on FortiOS/FortiProxy devices
- Suspicious scheduled-task activity on firewalls
- Unexpected
psexec.py,smbclient.py, orsecretsdump.pyactivity - Large-scale NTDS database access
- Unusual SMB and RDP lateral movement
- OpenSSH downloads from suspicious external infrastructure
- Deletion of Volume Shadow Copies
- Backup deletion or modification
- Large outbound transfers to cloud/file-sharing services
- Rapid modifications of large numbers of files
- Files receiving the
.ENCRTextension - Creation of
R3ADM3.txtransom notes - Unauthorized modifications to MFA or authentication configuration
Recommended Mitigations
- Patch all internet-facing FortiOS and FortiProxy systems against CVE-2024-55591 and CVE-2025-24472.
- Audit firewall and VPN administrator accounts for unauthorized users.
- Investigate the creation of accounts such as
forticloud-sync. - Monitor privileged SMB, RDP and SSH activity.
- Detect and investigate Impacket usage.
- Protect Active Directory and domain-controller credentials.
- Monitor for Volume Shadow Copy deletion.
- Protect backup infrastructure from administrative compromise.
- Maintain offline or immutable backups.
- Monitor large-scale outbound data transfers.
- Deploy endpoint ransomware behavior detection.
- Hunt for rapid file-encryption activity and
.ENCRTfile creation.
Threat Assessment
Gunra represents a significant ransomware threat because it combines initial-access exploitation, credential theft, lateral movement, data exfiltration and high-speed encryption into a single attack chain.
The use of multithreaded encryption reduces the available response window for defenders, while double extortion increases the impact even when organizations can recover their encrypted systems from backups.
Organizations operating internet-facing FortiOS/FortiProxy infrastructure should prioritize vulnerability remediation and proactively hunt for unauthorized administrative accounts and suspicious post-exploitation activity.