Gunra Ransomware Gang Exploits Fortinet Vulnerabilities, Bypasses MFA

According to reporting from Dark Reading, the Gunra ransomware-as-a-service operation has been finding success against critical infrastructure targets by exploiting vulnerabilities in Fortinet firewall and VPN appliances. The operation is reported to be leveraging leaked Conti ransomware code alongside known older vulnerabilities in Fortinet products to bypass multi-factor authentication measures.

The attacks have been observed targeting critical infrastructure organizations globally, with Fortinet firewalls and VPN appliances identified as the primary attack vectors. The exploitation of these vulnerabilities allows the threat actors to gain initial access to targeted networks, with the MFA bypass capability increasing the success rate of subsequent attacks.

The use of leaked Conti code suggests a trend of ransomware operations repurposing established ransomware frameworks and exploit techniques. The specific Fortinet vulnerabilities being exploited are described as "old flaws," indicating that the vulnerabilities being targeted may be known and potentially patched, though the attacks continue to succeed against organizations that have not applied available updates.

Dark Reading's report notes that Fortinet has issued security advisories and patches for the identified vulnerabilities, and recommends that affected organizations immediately apply patches and review their MFA configurations. The exact methodology of the MFA bypass and the specific vulnerability details were not fully enumerated in the available source material.