Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA

The Gunra ransomware group is actively exploiting known, older vulnerabilities in Fortinet firewall and VPN appliances — meaning affected organizations had windows of opportunity to patch but did not act in time. Compounding the risk, the group leverages leaked Conti ransomware code to circumvent MFA protections, demonstrating that MFA alone is insufficient when underlying systems remain unpatched and misconfigured. This attack highlights a dangerous assumption: that implementing a single control like MFA constitutes adequate defense. Internet-facing network appliances are high-value targets, and delayed patching of these devices can expose an organization's entire network perimeter. The combination of unpatched vulnerabilities and MFA bypass capability significantly lowers the barrier for ransomware actors to compromise critical infrastructure.